All Products
Search
Document Center

Edge Security Acceleration:Configure custom protection policies

Last Updated:Jun 30, 2026

DCDN allows you to define access control rules based on precise match conditions and set access frequency limits. You can customize protection policies to suit your business scenarios, such as hotlink protection and admin console access control.

Prerequisites

Background information

A custom protection policy is implemented through custom rules. Custom rules are categorized into the following types:

  • Access control rules: Define request feature match conditions based on client IP addresses, request URLs, and common request header fields. Requests that meet the conditions are handled accordingly. For example, you can use custom rules to intercept requests that access a specified URI or to validate requests that contain a specified User-Agent. For the request feature fields supported by custom rules, see Match conditions.

  • Frequency control rules: Based on access control match conditions, define access frequency detection conditions and handle statistical objects with abnormal access frequencies. For example, if the same IP address or session frequently triggers match conditions within a short period, you can enable frequency control to temporarily intercept requests from that IP address or session.

Create a custom protection policy

  1. Log on to the DCDN console.

  2. In the left-side navigation pane, choose WAF Protection > Protection Policy.

  3. On the Protection Policy page, click Create Policy.

  4. On the Create Protection Policy page, configure the policy information.

    Configuration module

    Parameter

    Description

    Policy information

    Policy Type

    Select Custom Protection Policies.

    Policy Name

    Enter a custom policy name. The name supports Chinese characters, English letters (case-sensitive), digits (0–9), and underscores (_). Maximum length: 64 characters.

    Set as Default Policy

    Toggle to set the current policy type as the default. Only one default policy can be set per policy type. Once created, a default policy cannot be replaced. If a default policy already exists, this toggle cannot be configured.

    Rule information

    Rule

    Custom protection policy rules. For configuration details, see Custom rule parameters. Up to 10 rules are supported per policy. To increase the quota, submit a ticket.

    Protected domain

    Select Association Mode

    A protected domain can be associated with multiple policies of the same type. If a domain already has another policy of the same type, you can choose to add and replace the existing policy or add and retain it. Domains already associated with a default policy only support replacement. Valid values:

    • Add and replace original policy: Unbind the existing policy and replace it with the current one.

    • Add and retain original policy: Both policies coexist without affecting each other.

    Select Domain

    Select the domain to be included in the current protection policy.

  5. Click Create Policy.

Custom rule parameters

You can create custom rules when setting up a new protection policy, or add rules to an existing policy at any time.

Parameter

Description

Rule Name

Enter a custom rule name. Supports Chinese characters, English letters (case-sensitive), digits (0–9), and underscores (_). Maximum length: 64 characters.

Match Condition

Set the request features to match for this rule. Click Add Condition to add a condition. Up to five conditions per rule. All conditions must be met simultaneously for the rule to trigger. Each condition consists of a Match Field, a Logical Operator, and Match Content. For configuration examples, see Match condition examples. For detailed descriptions of match fields and logical operators, see Match conditions.

Rate Limiting

Enable or disable frequency control. When enabled, if requests from the same statistical object (IP, session, etc.) frequently trigger the rule within a period, all requests from that object are handled accordingly for a specified duration. After enabling, you must configure frequency control parameters. For details, see Frequency control parameters.

Action

Select the protection action to execute when a request matches the rule. Valid values:

  • Block: Intercept the matching request and return a block response page.

  • JS Challenge: Return a JavaScript code snippet that normal browsers auto-execute. If executed successfully, requests are allowed for 30 minutes without re-validation.

  • Slider Challenge: Return a slider verification page. If the client passes, requests are allowed for 30 minutes.

  • Monitor: Do not intercept; only log matching requests. Use this to test new rules for false positives before switching to block mode. Log service must be enabled for log queries.

Frequency control parameters

When the Rate Limiting toggle is enabled, configure the following parameters:

Type

Parameter

Description

Example

Frequency detection condition

Statistical Object

Select the object for request frequency statistics. Valid values:

  • IP: Frequency from the same IP address.

  • Custom Header: Frequency of requests containing a specified header.

  • Custom Parameters: Frequency of requests containing a specified parameter.

  • Custom Cookie: Frequency of requests containing a specified cookie.

  • Session: Frequency from the same session.

Statistics object: IP, period: 60 seconds, threshold: 10. If a client IP address triggers match conditions more than 10 times within 60 seconds, it is blacklisted. Since DCDN consists of distributed nodes, this threshold may not be 100% accurate. Set a threshold slightly lower than expected.

Statistical Interval (Seconds)

Set the statistical period. Valid values: 5–1,800. Unit: seconds.

Threshold

  • Request Count Threshold: Maximum times a statistical object can trigger match conditions within the detection period. Valid values: 2–50,000. Unit: count.

  • Traffic Threshold: Maximum traffic volume within the detection period.

  • Both: Both conditions must be met simultaneously.

Response code detection condition

Status Code

Enable response code detection alongside frequency detection. When enabled, the object must satisfy both the frequency condition and a specific response code feature. Specify the response code to count.

Response code: 404, count: 5. If an IP triggers match conditions more than 10 times and receives 404 responses more than 5 times within 60 seconds, it is blacklisted.

Count

Maximum occurrences of a specified response code within the detection period. Choose either count or percentage, not both.

Percentage (%)

Maximum percentage of a specified response code within the detection period. Choose either count or percentage, not both.

Blacklist handling

Apply To

Scope of blacklist handling. Valid values:

  • Current Match Condition: Only intercept requests that meet the current rule's conditions.

  • All requests on the domain: Intercept all requests from the restricted object.

Blacklist the object that triggered frequency detection. For the specified duration, handle requests using the defined action.

Timeout Period

Duration of the blacklist. Valid values: 60–86,400. Unit: seconds.

Related APIs