Custom protection policies let you define access control rules based on precise match conditions and set access frequency limits for scenarios such as hotlink protection and admin console access control.
Prerequisites
The Edge WAF service is activated. For more information, see Activate Edge WAF.
You have added a domain name to Edge WAF. For more information, see Add a protected domain name.
Background information
Custom protection policies are implemented through custom rules, which fall into the following types:
-
Access control rules: Define match conditions based on client IP addresses, request URLs, and common request header fields. Requests that meet the conditions are handled accordingly. For example, intercept requests that access a specified URI or validate requests that contain a specified User-Agent. For the request feature fields supported by custom rules, see Match conditions.
-
Frequency control rules: Based on access control match conditions, define frequency detection thresholds and handle objects with abnormal access frequencies. For example, if the same IP address or session frequently triggers match conditions within a short period, frequency control can temporarily intercept requests from that source.
Create a custom protection policy
-
Log on to the DCDN console.
-
In the left-side navigation pane, choose .
-
On the Protection Policy page, click Create Policy.
-
On the Create Protection Policy page, configure the policy information.
Configuration module
Parameter
Description
Policy information
Policy Type
Select Custom Protection Policies.
Policy Name
Enter a policy name. Supports Chinese characters, English letters (case-sensitive), digits (0–9), and underscores (_). Maximum length: 64 characters.
Set as Default Policy
Set this policy as the default for its type. Only one default policy is allowed per type. Once created, a default policy cannot be replaced. If one already exists, this toggle is unavailable.
Rule information
Rule
Custom protection policy rules. For configuration details, see Custom rule parameters. Up to 10 rules are supported per policy. To increase the quota, submit a ticket.
Protected domain
Select Association Mode
A domain can be associated with multiple policies of the same type. If a domain already has a policy of the same type, you can replace or retain it. Domains associated with a default policy support replacement only. Valid values:
-
Add and replace original policy: Unbind the existing policy and replace it with the current one.
-
Add and retain original policy: Both policies coexist without affecting each other.
Select Domain
Select the domain to protect with this policy.
-
-
Click Create Policy.
Custom rule parameters
Create custom rules when setting up a new protection policy, or add rules to an existing policy at any time.
|
Parameter |
Description |
|
Rule Name |
Enter a rule name. Supports Chinese characters, English letters (case-sensitive), digits (0–9), and underscores (_). Maximum length: 64 characters. |
|
Match Condition |
Set the match conditions for this rule. Click Add Condition to add a condition. Up to five conditions per rule. All conditions must be met simultaneously for the rule to trigger. Each condition consists of a Match Field, a Logical Operator, and Match Content. For configuration examples, see Match condition examples. For detailed descriptions of match fields and logical operators, see Match conditions. |
|
Rate Limiting |
Enable frequency control. When enabled, if requests from the same statistical object (IP, session, etc.) frequently trigger the rule within a period, all requests from that object are handled accordingly for a specified duration. Configure the frequency control parameters below. For details, see Frequency control parameters. |
|
Action |
Select the action to take when a request matches the rule. Valid values:
|
Frequency control parameters
When the Rate Limiting toggle is enabled, configure the following parameters:
|
Type |
Parameter |
Description |
Example |
|
Frequency detection condition |
Statistical Object |
Select the object to track for frequency statistics. Valid values:
|
Statistics object: IP, period: 60 seconds, threshold: 10. If a client IP triggers match conditions more than 10 times within 60 seconds, it is blacklisted. Because DCDN consists of distributed nodes, this threshold may not be fully precise. Set a threshold slightly lower than expected. |
|
Statistical Interval (Seconds) |
Set the statistical period. Valid values: 5–1,800. Unit: seconds. |
||
|
Threshold |
|
||
|
Response code detection condition |
Status Code |
Enable response code detection alongside frequency detection. When enabled, the object must satisfy both the frequency threshold and a specific response code condition. Specify the response code to count. |
Response code: 404, count: 5. If an IP triggers match conditions more than 10 times and receives 404 responses more than 5 times within 60 seconds, it is blacklisted. |
|
Count |
Maximum occurrences of a specified response code within the detection period. Choose either count or percentage, not both. |
||
|
Percentage (%) |
Maximum percentage of a specified response code within the detection period. Choose either count or percentage, not both. |
||
|
Blacklist handling |
Apply To |
Scope of blacklist handling. Valid values:
|
Blacklists the object that triggered frequency detection. For the specified duration, requests are handled using the defined action. |
|
Timeout Period |
Duration of the blacklist. Valid values: 60–86,400. Unit: seconds. |