All Products
Search
Document Center

Anti-DDoS:Add one or more websites

Last Updated:Feb 23, 2024

After you add the domain name of a website to Anti-DDoS Proxy, Anti-DDoS Proxy assigns a CNAME to the website. You must change the DNS record to map the domain name to the CNAME. This way, service traffic can be switched to Anti-DDoS Proxy for protection. This topic describes how to add websites.

Usage notes

Internet Content Provider (ICP) filing must be complete for the domain name of your website that is added to Anti-DDoS Proxy (Chinese Mainland). ICP filing is not required if your website is added to Anti-DDoS Proxy (Outside Chinese Mainland).

Note
  • Anti-DDoS Proxy (Chinese Mainland) checks the status of ICP filing for protected domain names on a regular basis. If the ICP filing of a domain name becomes invalid, Anti-DDoS Proxy (Chinese Mainland) no longer forwards the traffic of the domain name and displays the "ICP filing for the domain name is not complete. Update the ICP filing status at the earliest opportunity" message on the Website Config page. If the message is displayed and you want to resume traffic forwarding, you must update the ICP filing information for the domain name at the earliest opportunity.

  • If your origin server is an Alibaba Cloud service, ICP filing requirements for Anti-DDoS Proxy (Chinese Mainland) and the Alibaba Cloud service must be met. Otherwise, forwarding of back-to-origin traffic is affected. For more information, see the documentation of each Alibaba Cloud service on the Alibaba Cloud official website or contact technical support. If the origin server of your website is an Elastic Compute Service (ECS) instance, you must complete ICP filing for the website. For more information, see Prepare and check the instance and access information and ICP filing application overview.

Prerequisites

Add one or more websites

  1. Log on to the Anti-DDoS Pro console.

  2. In the top navigation bar, select the region of your asset.

    • Anti-DDoS Proxy (Chinese Mainland): If your instance is an Anti-DDoS Pro instance, select Chinese Mainland.

    • Anti-DDoS Proxy (Outside Chinese Mainland): If your instance is an Anti-DDoS Premium instance, select Outside Chinese Mainland.

    You can switch the region to configure and manage Anti-DDoS Pro or Anti-DDoS Premium instances. Make sure that you select the required region when you use Anti-DDoS Pro or Anti-DDoS Premium.

  3. In the left-side navigation pane, choose Provisioning > Website Config.

  4. On the Website Config page, add one or more websites.

    • Add a website to Anti-DDoS Proxy

      Click Add Website, follow the instructions on the page to complete the Enter Website Information step, and then click Add.

      Parameter

      Description

      Function Plan

      The function plan of the Anti-DDoS Proxy instance that you want to use. Valid values: Standard and Enhanced.

      Note

      You can move the pointer over the 功能套餐说明 icon next to Function Plan to view the differences between the Standard and Enhanced function plans. For more information, see Function plans.

      Instance

      The Anti-DDoS Proxy instance that you want to use.

      You can associate up to eight instances with a domain name. The instances associated with the domain name must use the same Function Plan.

      Websites

      The domain name of the website that you want to protect. The domain name must meet the following requirements:

      • The domain name can contain letters, digits, and hyphens (-). The domain name must start with a letter or a digit.

      • The domain name can be a wildcard domain name, such as *.aliyundoc.com. If you enter a wildcard domain name, Anti-DDoS Proxy automatically matches all subdomains of the wildcard domain name.

      • If you configure a wildcard domain name and an exact-match domain name, the forwarding rules and mitigation policies of the exact-match domain name take precedence. For example, if you configure *.aliyundoc.com and www.aliyundoc.com, the forwarding rules and mitigation policies of www.aliyundoc.com take precedence.

      Note

      If you configure a second-level domain name, Anti-DDoS Proxy protects only the second-level domain name. Anti-DDoS Proxy does not protect subdomains of the second-level domain name. If you want to protect a subdomain, configure the subdomain or a wildcard domain name.

      Protocol Type

      The type of the protocol that the website uses. Valid values:

      • HTTP

      • HTTPS: If the website uses HTTPS, select HTTPS. You must upload an SSL certificate file after you save the website. For more information, see Upload an HTTPS certificate. You can also customize a Transport Layer Security (TLS) policy for the website. For more information, see Customize TLS security policies.

        If you select HTTPS, you can click Advanced Settings to configure the following options.

        • Enable HTTPS Redirection: If the website supports both HTTP and HTTPS, this feature is available. If you enable this feature, all HTTP requests to access the website are redirected to HTTPS requests on the standard port 443.

          Important
          • This feature is available only when both HTTP and HTTPS are selected and Websocket is cleared.

          • If you access the website over HTTP on a non-standard port and enable this feature, all HTTP requests are redirected to HTTPS requests on the standard port 443.

        • Enable HTTP Redirection of Back-to-origin Requests: If the website does not support HTTPS, you must turn on Enable HTTP. If this feature is enabled, all HTTPS requests are redirected to HTTP requests and forwarded to origin servers, and all WebSockets requests are redirected to WebSocket requests and forwarded to origin servers. By default, the requests are redirected over the standard port 80.

          Important

          If you access the website over HTTPS on a non-standard port and enable this feature, all HTTPS requests are redirected to HTTP requests on the standard port 80.

        • Enable HTTP/2: After you turn on Enable HTTP/2, clients that use HTTP/2 can be added to Anti-DDoS Proxy. In this case, Anti-DDoS Proxy forwards all client requests to origin servers over HTTP/1.1.

          Description of the HTTP/2 feature:

          • Timeout period for idle connections (http2_idle_timeout): 120s

          • Maximum number of requests per connection (http2_max_requests): 1000

          • Maximum number of concurrent streams per connection (http2_max_concurrent_streams): 4

          • Maximum size of the entire request header list after HPACK decompression (http2_max_header_size): 256K

          • Maximum size of an HPACK-compressed request header field (http2_max_field_size): 64K

      • Websocket: If you select Websocket, HTTP is automatically selected. You cannot select only Websocket for the Protocol parameter.

      • Websockets: If you select Websockets, HTTPS is automatically selected. You cannot select only Websockets for the Protocol parameter.

      Enable OCSP

      Specifies whether to enable the Online Certificate Status Protocol (OCSP) feature.

      Important

      This feature is available only for a website that supports HTTPS. If HTTPS is selected for Protocol Type, we recommend that you enable this feature.

      OCSP is an Internet protocol that is used by a Certificate Authority (CA) to check the revocation status of a certificate. When a client initiates a TLS handshake with a server, the client must obtain the certificate and an OCSP response.

      • The OCSP feature is disabled by default. In this case, OCSP queries are sent from a browser of the client to a CA. Before the client obtains an OCSP response, subsequent events are blocked. If transient connections or network disconnections occur, a blank page is displayed for a long period of time, and the performance of the website that supports HTTPS is compromised.

      • If the OCSP feature is enabled, Anti-DDoS Proxy executes OCSP queries and caches the query results for 300 seconds. When a client initiates a TLS handshake with the server, Anti-DDoS Proxy returns the OCSP details and the certificate chain to the client. This prevents blocking issues caused by OCSP queries from the client. OCSP does not cause security risks because OCSP responses cannot be forged.

      Server Address

      The address type of the origin server. You must enter the address of the origin server. Valid values:

      • Origin IP Address: the IP address of the origin server. You can enter up to 20 IP addresses. If you enter more than one IP address, separate them with commas (,).

        • If the origin server is hosted on an ECS instance, enter the public IP address of the ECS instance. If the ECS instance is associated with a Server Load Balancer (SLB) instance, enter the public IP address of the SLB instance.

        • If the origin server is deployed in data centers or on other clouds, you can run the ping Domain name command to query the public IP address to which the domain name is resolved and enter the public IP address.

      • Origin Domain Name: the domain name of the origin server. Select this option when you deploy a proxy service, such as Web Application Firewall (WAF), between the origin server and Anti-DDoS Proxy. You must also enter the address of the proxy. You can enter up to 10 domain names. If you enter more than one domain name, separate them with line breaks.

        If you want to use Anti-DDoS Proxy together with WAF, select Origin Domain Name and enter the CNAME that WAF assigns. This provides enhanced protection for the website. For more information, see Protect a website service by using both Anti-DDoS Proxy and WAF.

        Important

        If you enter the default public endpoint of an Object Storage Service (OSS) bucket for Origin Domain Name, a custom domain name must be mapped to the bucket. For more information, see Regions and endpoints and Map custom domain names.

      If you enter more than one IP address or domain name, Anti-DDoS Proxy uses IP hash to forward website traffic to the origin servers. After you save the website configurations, you can change the load balancing algorithm. For more information, see Modify the back-to-origin settings for a website.

      Server Port

      The server port that you specify based on the value of Protocol Type.

      • If you select HTTP or Websocket, the default port 80 is used.

      • If you select HTTPS, HTTP/2, or Websockets, the default port 443 is used.

      You can click Custom to the right of the Server Port parameter to specify one or more custom ports. If you specify multiple custom ports, separate the ports with commas (,). Take note of the following limits when you specify custom ports:

      • The custom ports that you want to specify must be supported by Anti-DDoS Proxy.

        • Anti-DDoS Proxy instance of the Standard:

          • HTTP ports: ports 80 and 8080

          • HTTPS ports: ports 443 and 8443

        • Anti-DDoS Proxy instance of the Enhanced:

          • HTTP ports: ports that range from 80 to 65535

          • HTTPS ports: ports that range from 80 to 65535

      • You can specify up to 10 custom ports for all websites that are added to your Anti-DDoS Proxy instance. The custom ports include HTTP ports and HTTPS ports.

        For example, you want to add Website A and Website B to your Anti-DDoS Proxy instance, Website A provides HTTP services, and Website B provides HTTPS services. If you specify HTTP ports 80 and 8080 for Website A, you can specify up to eight HTTPS ports for Website B.

      CNAME Reuse

      Specifies whether to enable CNAME reuse. This parameter is available only for Anti-DDoS Proxy (Outside Chinese Mainland).

      If more than one website is hosted on the same server, this feature is available. After CNAME reuse is enabled, you need only to map the domain names hosted on the same server to the CNAME that is assigned by Anti-DDoS Proxy (Outside Chinese Mainland). For more information, see Use the CNAME reuse feature.

    • Import multiple websites at a time

      1. Click Batch Import in the lower part of the Website Config page. In the Batch Create panel, enter the information about the websites that you want to add and click Next.

        Note

        Make sure that you save the information about the websites as an XML file. If the information in the XML file is valid, the information is parsed and imported. For more information about file formats, see Website configurations in an XML file.

      2. In the Import Rule panel, select the websites that you want to import and click OK.

Subsequent configurations

  1. Optional. Change the public IP address of an ECS origin server.

    If your origin server is an ECS instance and the origin IP address is exposed, you must change the public IP address of the ECS instance. This prevents attackers from bypassing Anti-DDoS Proxy to attack your origin server. For more information, see Change the public IP address of an ECS origin server.

  2. The back-to-origin CIDR blocks of the Anti-DDoS Proxy instance are added to the whitelist of the origin server.

    If security software, such as a firewall, is installed on the origin server, you must add the back-to-origin IP addresses of the Anti-DDoS Proxy instance to the whitelist of the origin server. This ensures that the traffic from Anti-DDoS Proxy is not blocked by the security software on your origin server. For more information, see Allow back-to-origin IP addresses to access the origin server.

  3. Check whether the forwarding settings take effect on your computer. For more information, see Verify traffic forwarding settings on a local machine.

    Warning

    If you switch your service traffic to Anti-DDoS Proxy before the forwarding settings take effect, your service may be interrupted.

  4. Change DNS records to switch service traffic to Anti-DDoS Proxy.

    Anti-DDoS Proxy assigns a CNAME to the website that you added. You must change the DNS record to map the domain name to the CNAME. This way, service traffic can be switched to Anti-DDoS Proxy for protection. For more information, see Change DNS records to protect website services.

  5. Optional. Configure mitigation settings for your website.

    By default, Anti-DDoS Global Mitigation Policy and Intelligent Protection are enabled for websites that are added. You can enable more features on the Protection for Website Services tab. For more information, see Protection for website services.

    Important

    After you enable the HTTP flood protection feature, cookies may be inserted. For more information, see Cookie insertion.

  6. Optional. Configure alert rules in CloudMonitor.

    CloudMonitor allows you to configure threshold-triggered alert rules for common service metrics and attack events of Anti-DDoS Proxy. The common service metrics include the volume of traffic for an Anti-DDoS Proxy instance and the number of connections for an Anti-DDoS Proxy instance. The traffic and connection metrics can be measured at the IP address level. The attack events include blackhole filtering events and traffic scrubbing events. After you configure a threshold-triggered alert rule, CloudMonitor reports an alert when the rule is triggered. This way, you can handle exceptions and recover your business at the earliest opportunity. For more information, see Use the alert monitoring feature of CloudMonitor.

  7. Optional. Configure the Log Analysis feature.

    Anti-DDoS Proxy collects and stores full logs of the website. This way, you can query and analyze the logs that are collected from the website. By default, the Log Analysis feature stores full logs for 180 days. This helps meet the requirements of classified protection. For more information, see Use the Log Analysis feature.

What to do next

Modify the configuration of a website

You can modify the configurations of one or more websites except the domain names of the websites. For example, you can add the websites to other Anti-DDoS Proxy instances or modify the origin IP addresses. You can modify multiple websites at a time.

Important

If you want to use another Anti-DDoS Proxy instance to protect an added domain name, follow the steps that are described in Switch service traffic to a new Anti-DDoS Proxy instance to make sure that service traffic is forwarded as expected.

  • Modify a website

    1. On the Website Config page, find the website that you want to modify and click Edit in the Actions column.

    2. On the details page, modify the website except the domain name of the website and click OK.

  • Modify multiple websites

    1. Click Batch Modify in the lower part of the Website Config page. In the Batch Modify panel, enter the information about the websites and click Next.

    2. In the Import Rule panel, select the websites that you want to import and click OK.

    3. Click Finish. The Uploaded. panel is closed.

Delete website configurations

Warning

If a website no longer needs anti-DDoS protection, you can delete the website. Before you perform this operation, you must update the DNS records and make sure that the DNS record values are not any of the following: the Anti-DDoS Pro instance IP, the CNAME assigned by Anti-DDoS Pro, or the CNAME assigned by security traffic manager. If you do not update the DNS records before you delete the website, services may be interrupted.

  1. On the Website Config page, find the website that you want to delete and click Delete in the Actions column.

  2. In the message that appears, click Delete.

Note

If you use Anti-DDoS Proxy (Chinese Mainland), you can delete multiple websites at a time. Select the websites that you want to delete and click Batch Delete below the website list. Select the websites that you want to delete and click Batch Delete below the website list.

References

To resolve the latency increase issue that occurs during normal service access, you can use Sec-Traffic Manager. If no attacks occur, service traffic is directly forwarded to the origin server without latency increase. If attacks occur, traffic is switched to Anti-DDoS Proxy for scrubbing and forwarding. For more information, see Sec-Traffic Manager.