DCDN allows you to define access control rules based on precise match conditions and set access frequency limits. You can customize protection policies to suit your business scenarios, such as hotlink protection and admin console access control.
Prerequisites
The Edge WAF service is activated. For more information, see Activate Edge WAF.
You have added a domain name to Edge WAF. For more information, see Add a protected domain name.
Background information
A custom protection policy is implemented through custom rules. Custom rules are categorized into the following types:
Access control rules: Define request feature match conditions based on client IP addresses, request URLs, and common request header fields. Requests that meet the conditions are handled accordingly. For example, you can use custom rules to intercept requests that access a specified URI or to validate requests that contain a specified User-Agent. For the request feature fields supported by custom rules, see Match conditions.
Frequency control rules: Based on access control match conditions, define access frequency detection conditions and handle statistical objects with abnormal access frequencies. For example, if the same IP address or session frequently triggers match conditions within a short period, you can enable frequency control to temporarily intercept requests from that IP address or session.
Create a custom protection policy
-
Log on to the DCDN console.
In the left-side navigation pane, choose .
On the Protection Policy page, click Create Policy.
On the Create Protection Policy page, configure the policy information.
Configuration module
Parameter
Description
Policy information
Policy Type
Select Custom Protection Policies.
Policy Name
Enter a custom policy name. The name supports Chinese characters, English letters (case-sensitive), digits (0–9), and underscores (_). Maximum length: 64 characters.
Set as Default Policy
Toggle to set the current policy type as the default. Only one default policy can be set per policy type. Once created, a default policy cannot be replaced. If a default policy already exists, this toggle cannot be configured.
Rule information
Rule
Custom protection policy rules. For configuration details, see Custom rule parameters. Up to 10 rules are supported per policy. To increase the quota, submit a ticket.
Protected domain
Select Association Mode
A protected domain can be associated with multiple policies of the same type. If a domain already has another policy of the same type, you can choose to add and replace the existing policy or add and retain it. Domains already associated with a default policy only support replacement. Valid values:
Add and replace original policy: Unbind the existing policy and replace it with the current one.
Add and retain original policy: Both policies coexist without affecting each other.
Select Domain
Select the domain to be included in the current protection policy.
Click Create Policy.
Custom rule parameters
You can create custom rules when setting up a new protection policy, or add rules to an existing policy at any time.
Parameter | Description |
Rule Name | Enter a custom rule name. Supports Chinese characters, English letters (case-sensitive), digits (0–9), and underscores (_). Maximum length: 64 characters. |
Match Condition | Set the request features to match for this rule. Click Add Condition to add a condition. Up to five conditions per rule. All conditions must be met simultaneously for the rule to trigger. Each condition consists of a Match Field, a Logical Operator, and Match Content. For configuration examples, see Match condition examples. For detailed descriptions of match fields and logical operators, see Match conditions. |
Rate Limiting | Enable or disable frequency control. When enabled, if requests from the same statistical object (IP, session, etc.) frequently trigger the rule within a period, all requests from that object are handled accordingly for a specified duration. After enabling, you must configure frequency control parameters. For details, see Frequency control parameters. |
Action | Select the protection action to execute when a request matches the rule. Valid values:
|
Frequency control parameters
When the Rate Limiting toggle is enabled, configure the following parameters:
Type | Parameter | Description | Example |
Frequency detection condition | Statistical Object | Select the object for request frequency statistics. Valid values:
| Statistics object: IP, period: 60 seconds, threshold: 10. If a client IP address triggers match conditions more than 10 times within 60 seconds, it is blacklisted. Since DCDN consists of distributed nodes, this threshold may not be 100% accurate. Set a threshold slightly lower than expected. |
Statistical Interval (Seconds) | Set the statistical period. Valid values: 5–1,800. Unit: seconds. | ||
Threshold |
| ||
Response code detection condition | Status Code | Enable response code detection alongside frequency detection. When enabled, the object must satisfy both the frequency condition and a specific response code feature. Specify the response code to count. | Response code: 404, count: 5. If an IP triggers match conditions more than 10 times and receives 404 responses more than 5 times within 60 seconds, it is blacklisted. |
Count | Maximum occurrences of a specified response code within the detection period. Choose either count or percentage, not both. | ||
Percentage (%) | Maximum percentage of a specified response code within the detection period. Choose either count or percentage, not both. | ||
Blacklist handling | Apply To | Scope of blacklist handling. Valid values:
| Blacklist the object that triggered frequency detection. For the specified duration, handle requests using the defined action. |
Timeout Period | Duration of the blacklist. Valid values: 60–86,400. Unit: seconds. |