Configure a usage cap for CDN - CDN - Alibaba Cloud Documentation Center

To prevent unexpected charges from traffic spikes or malicious attacks, you can set a usage cap. This feature limits the bandwidth, traffic, or number of HTTPS requests for an accelerated domain name, which helps you control costs and minimize losses from sudden usage surges.

Background

When you use Alibaba Cloud CDN to accelerate your services, you may encounter the following issues:

Sudden traffic surges: Your website or application traffic increases dramatically in a short period due to trending topics or other events. This can cause your CDN bandwidth or traffic to significantly exceed normal levels, resulting in high costs.
Malicious traffic attacks: Your services are targeted by a CC attack or DDoS attack. Attackers generate a massive volume of requests or consume significant bandwidth, which disrupts your operations and causes major financial losses.

To help you proactively control costs and manage risks, Alibaba Cloud CDN provides the usage cap feature. You can set a threshold for the bandwidth, traffic, or number of HTTPS requests for an accelerated domain name. When usage in a statistical period reaches your configured threshold, CDN automatically takes the domain name offline to suspend the acceleration service and prevent costs from increasing further. This feature is a key tool for CDN cost management and security.

Feature overview

The usage cap feature includes three modes: bandwidth cap, traffic cap, and HTTPS requests cap. When a rule in any of these modes is triggered, the corresponding accelerated domain name is automatically taken offline. The service resumes automatically after the specified unblocking time.

Traffic cap

This mode monitors the total traffic for a domain name over a specified period. The cap rule is triggered when the accumulated traffic exceeds the threshold you set. This feature is ideal for users with a pay-by-traffic billing model, as it helps you keep total costs within your budget.

Parameter	Description
Statistical period	The period over which traffic usage is accumulated. The system sums the traffic within this period and compares it to the threshold. Options: Every 5 minutes, Every hour, Before midnight (resets daily at 00:00), or Monthly (resets at the end of each month).
Threshold	The maximum total traffic allowed within one statistical period. If the accumulated traffic exceeds this threshold, the accelerated domain name is taken offline. Range: 1 MB to 10,000 TB.
Unblocking time	The duration after which the system automatically brings the domain name back online to resume the CDN service. Options: 5 minutes, 1 hour, 1 day, 1 month, or Never (the domain name remains offline until you manually bring it back online or delete the usage cap configuration).

Bandwidth cap

This mode monitors the peak bandwidth of a domain name. When the real-time monitored bandwidth exceeds the threshold you set, the cap rule is triggered. This feature is ideal for users with a pay-by-peak-bandwidth billing model, as it effectively controls the upper limit of your billable bandwidth.

Parameter	Description
Threshold	The bandwidth cap for the domain name, monitored at CDN POPs. If the bandwidth within a 5-minute statistical period exceeds this threshold, the accelerated domain name is taken offline. Range: 1 Mbps to 1 Tbps.
Unblocking time	The duration after which the system automatically brings the domain name back online to resume the CDN service. Options: 5 minutes, 1 hour, 1 day, 1 month, or Never (the domain name remains offline until you manually bring it back online or delete the usage cap configuration).

HTTPS requests cap

This mode monitors the total number of HTTPS requests for a domain name over a specified period. The cap rule is triggered when the accumulated number of requests exceeds the threshold you set. This feature is useful for scenarios where you need to control spending on HTTPS requests within a strict budget.

Parameter	Description
Statistical period	The period over which the number of HTTPS requests is accumulated. The system sums the requests within this period and compares the total to the threshold. Options: Every 5 minutes, Every hour, Before midnight (resets daily at 00:00), or Monthly (resets at the end of each month).
Threshold	The maximum total number of HTTPS requests allowed within one statistical period. If the accumulated number of requests exceeds this threshold, the accelerated domain name is taken offline. Range: 1 million to 10 billion requests.
Unblocking time	The duration after which the system automatically brings the domain name back online to resume the CDN service. Options: 5 minutes, 1 hour, 1 day, 1 month, or Never (the domain name remains offline until you manually bring it back online or delete the usage cap configuration).

Usage notes

Monitoring data latency: Usage monitoring data has a latency of approximately 10 minutes. As a result, after the actual usage reaches the threshold, it takes about 10 minutes for the system to take the domain name offline. All resource consumption (traffic, bandwidth, requests, etc.) during this delay is billed normally.
Careful threshold evaluation: Once you configure a usage cap, the system takes your domain name offline if the threshold is reached. This disrupts all access through the CDN, causing all requests to fail. Always evaluate and set a reasonable threshold based on historical business data and future expectations to avoid impacting your normal operations.
Automatic unblocking: When a domain name is taken offline because a cap was triggered, the system starts a countdown timer based on your configured unblocking time. Even if you manually bring the domain name back online during this period, the system will automatically reactivate it when the unblocking time is reached. If you want the domain name to remain offline after the cap is triggered, you can delete the usage cap configuration to prevent the system from automatically reactivating the domain name.

Procedure

On the Domain Names page, find the target domain name and click Actions in the Manage column.
In the domain's navigation pane, click Traffic Throttling.
On the Usage Cap tab, select the type of cap to configure.
Click Modify Configuration and select a Statistical period, Threshold, and Unblocking time based on your business needs. For details about the parameters, see Feature overview.
Click OK. The cap rule is created and takes effect immediately.

Behavior and recovery after a domain name is taken offline due to a usage cap

When a domain name is automatically taken offline because a usage cap is triggered, you will observe the following:

The DNS resolution may point to an invalid address (such as offline.*.kunlun*.com) or return a 614 status code, causing the website to become inaccessible.
In the CDN console domain name list, the status of the domain name will be displayed as Disabled.

You can recover the domain name in one of the following ways:

Wait for automatic recovery: The system automatically starts a countdown based on your configured unblocking time. When the unblocking time is reached, the domain name is automatically brought back online.
Manually enable the domain name: If you want to restore access earlier, go to the CDN console, find the target domain name, and click the Enable button in the Actions column to bring the domain name back online.

Note

If you want the domain name to remain offline after a cap is triggered and not be automatically brought back online, delete the usage cap configuration.

Delete a usage cap configuration

To completely remove a usage cap rule and stop it from taking effect, you must delete the configuration rather than simply turning off the switch.

On the Domain Names page, find the target domain name and click Manage in the Actions column.
On the Usage Cap tab, locate the cap configuration that you want to remove (Bandwidth Cap, traffic Cap, or HTTPS Requests Cap).
Click Delete Configuration.
In the confirmation dialog box, click OK.

After the configuration is deleted, the corresponding usage cap rule is permanently removed and the system no longer monitors or enforces the threshold for that cap type. If you turn off the switch without deleting the configuration, the usage cap policy may still take effect.

FAQ

Bandwidth exceeding cap threshold

Because monitoring data for domain name bandwidth has a latency of about 10 minutes, the domain name is taken offline approximately 10 minutes after the actual bandwidth reaches the threshold. Any resource consumption, such as traffic, bandwidth, and requests, that occurs before the domain name is taken offline is billed normally. The following examples provide more details:

Example 1 (pay-by-peak-bandwidth):
Customer A uses the pay-by-peak-bandwidth billing model, has added only the domain name example.com, and has enabled the bandwidth cap feature with a threshold of 10 Gbps. Therefore, the pay-by-peak-bandwidth bill for February 1, 2021, will be calculated based on a peak bandwidth of 25 Gbps.
Between 21:00 and 21:01 on February 1, 2021, the bandwidth suddenly surges to 10 Gbps. Due to monitoring data latency, the domain name is not taken offline until around 21:11 on February 1, 2021. Before being taken offline, the peak bandwidth reaches 25 Gbps.
Example 2 (pay-by-traffic):
Customer B uses the pay-by-traffic billing model, has added only the domain name example.com, and has enabled a bandwidth cap for the domain name with a threshold of 10 Gbps.
Between 21:00 and 21:01 on February 1, 2021, the bandwidth suddenly surges to 10 Gbps, consuming 30 GB of traffic. Due to monitoring data latency, the domain name is not taken offline until around 21:11 on February 1, 2021. During this latency period, an additional 400 GB of traffic is used. All traffic generated by example.com before it is taken offline is included in the pay-by-traffic bill for the period from 21:00 to 22:00 on February 1, 2021.

Throttle by IP address

No. The CDN usage cap applies to the total usage of the entire domain name. You cannot limit traffic or bandwidth for a specific IP address. If you need to throttle traffic by client IP, we recommend that you use the WAF frequency control feature of [Edge Security Acceleration (ESA)](https://www.alibabacloud.com/help/en/esa).

What do I do if my domain name remains offline or is automatically suspended after I delete or close a usage cap configuration?

If your domain name remains offline after you delete or close a usage cap configuration, check the following:

Legacy bandwidth cap rules: Your domain name may also have legacy bandwidth cap rules configured (alert rules in CloudMonitor). When a legacy rule is triggered, it also takes the domain name offline. Legacy rules cannot be modified directly and must be deleted. Go to the CloudMonitor console to check and delete legacy bandwidth cap rules, and retain only the new usage cap configuration.
Usage cap not fully deleted: Simply closing the usage cap switch does not stop the policy. Confirm that you have completely deleted the usage cap configuration.
Domain name requires manual enabling: After a domain name is taken offline, you must manually enable it in the CDN console or wait for the configured unblocking time to expire before access can be restored.

Does CDN support traffic limits for a single IP address or rate limiting for a specific IP?

No. The CDN usage cap applies to the total usage (bandwidth, traffic, and HTTPS requests) of an entire domain name and cannot be applied to individual IP addresses. If you need frequency control or blocking based on client IP addresses, we recommend that you use the WAF frequency control feature of [Edge Security Acceleration (ESA)](https://www.alibabacloud.com/help/en/esa). When a client IP exceeds the configured frequency threshold, requests from that IP are blocked with a 403 status code.

How do I troubleshoot frequent automatic domain name suspensions or sudden inaccessibility?

If your CDN domain name is frequently taken offline or suddenly becomes inaccessible, perform the following checks:

Check usage cap configurations: Log on to the CDN console, go to Domain Names, find the target domain name, and check the Usage Cap page under Traffic Limits to see if bandwidth, traffic, or HTTPS request cap policies are configured and whether a threshold has been triggered. Also check the operation records for cap trigger records.
Check legacy bandwidth cap rules: Confirm whether legacy bandwidth cap rules (CloudMonitor alert rules) conflict with the new usage cap policies.
Investigate abnormal traffic: If you suspect an abnormal traffic attack, view offline logs in the console or enable Operation Reports to analyze top IP addresses and top referers. If abnormal IPs are identified, you can configure IP blacklists or whitelists. If empty referer requests are causing excessive traffic, configure referer anti-leech. For more advanced protection, consider upgrading to the ESA product.

Can I configure my service to automatically stop after my CDN resource plan is exhausted to avoid pay-as-you-go charges?

CDN does not support a "stop when resource plan is exhausted" configuration. When your CDN resource plan is exhausted, the system automatically switches to the pay-as-you-go billing model, and you cannot disable pay-as-you-go billing.

To avoid high pay-as-you-go charges after your resource plan is exhausted, we recommend the following:

Configure a usage cap: Set appropriate bandwidth or traffic thresholds. When usage reaches the threshold, the domain name is automatically taken offline, preventing further charges.
Set resource plan alerts: Configure an alert for when your resource plan reaches a remaining threshold (for example, 10 GB) so you can intervene in time. Note that resource plan alerts may have a delay, and excess charges may have already been incurred when you receive the alert.

How do I set a reasonable usage cap threshold?

There is no universal default threshold. Set a value based on your actual business scale and traffic patterns to avoid accidentally taking your domain name offline.

Check your historical usage: In the CDN console, go to Usage > Usage Query to view bandwidth and traffic trends for the past 7 days. Use the historical peak as a baseline and add an appropriate buffer to account for normal traffic fluctuations.
Reference ranges by business type: For small to medium-sized websites, hourly traffic typically ranges from a few GB to tens of GB. Video streaming and large file download services may produce TB-level traffic. Set thresholds above your normal peak levels to prevent unnecessary service interruptions.
Avoid setting thresholds too low: A threshold that is too low can cause frequent domain name suspensions and disrupt normal business operations. Start with a higher threshold and adjust it downward as you gain more insight into your actual usage patterns.

How do I view the time and reason for a domain name suspension due to a usage cap?

To check when your domain name was taken offline and the reason for the suspension:

Log on to the CDN console and go to Domain Names. Find the target domain name and click Manage.
Navigate to the Usage Cap. Check the current cap configurations and their status to see whether any threshold has been triggered.
Review the operation records. The records display the specific suspension time (for example, 2025-05-12 09:33:51) and the suspension reason (for example, "Usage cap policy triggered").

Is the bandwidth cap feature free? What happens when it is triggered?

The bandwidth cap feature is free of charge. No additional fees are incurred for enabling or using this feature.

When the bandwidth of a domain name within a 5-minute statistical period exceeds the configured threshold, CDN automatically takes the domain name offline (the domain enters the disabled state). After the domain name is taken offline:

All requests to the domain name fail, including both legitimate and malicious requests. Your website becomes inaccessible through CDN.
The domain name remains offline until the configured Unblocking time is reached, at which point the system automatically brings the domain name back online.

This mechanism helps you prevent unexpectedly high bandwidth or traffic charges by proactively stopping the acceleration service when usage exceeds your expected limits.