DCDN integrates Web Application Firewall (WAF) capabilities at DCDN points of presence (POPs) to identify malicious traffic and intercept malicious requests.
Alibaba Cloud DCDN will stop offering the WAF protection feature to new users starting at 00:00 (UTC+8) on May 1, 2025. Users who have already enabled the service are not affected.
If you need this feature, we recommend that you upgrade to ESA Edge Security Acceleration service. The WAF protection of ESA provides better protection than the WAF of DCDN.
Benefits
WAF deeply integrates the core WAF engine into DCDN points of presence (POPs). The redesigned console workflow improves security O&M efficiency, streamlines the user experience, and expands website protection options.
Compared to previous WAF versions, the new WAF offers the following advantages:
-
New cloud-native architecture:
The WAF engine is deeply integrated into DCDN POPs. All traffic to your domain names passes through WAF, ensuring that features such as the web regular expression engine and custom rules are enforced at the edge for comprehensive protection.
-
New protection configuration model:
WAF uses a flexible policy configuration model. You can apply protection policies and rules to multiple domain names in batches, significantly improving configuration efficiency.
Note-
A protected domain name is a domain name with the WAF feature enabled.
-
A protection policy is a collection of protection rules. You can configure a default policy to apply a predefined set of rules to all newly protected domain names. You can also customize protection policies to meet specific requirements.
-
A protection rule is a specific rule defined within a protection policy. Examples include the medium-level rule group for web regular expression protection and access control rules within a custom policy.
-
-
New pay-as-you-go billing model:
WAF uses a pay-as-you-go billing model with the Security Capacity Unit (SeCU) as the standard unit of measurement. All billable items are converted into SeCUs, lowering the billing threshold and simplifying billing. Bills are generated hourly based on SeCU usage.
WAF features
The following table lists the protection features that WAF supports.
|
Feature |
Sub-feature |
WAF support |
|
Domain name management |
Configuration management |
Supported |
|
Whitelist |
Whitelist for precise access control |
Supported |
|
Web security |
Regular expression protection Zero-day rule updates |
Supported |
|
Warning and block modes Anti-obfuscation decoding |
Supported |
|
|
Custom regular expression protection rule groups |
Supported |
|
|
Access control/throttling |
IP blacklist |
Supported |
|
Region blacklist |
Supported |
|
|
Custom protection policies |
Supported |
|
|
Scan protection |
Supported |
|
|
Monitoring and reports |
Overview and reports |
Supported |
|
Log service |
Real-time log |
Supported |
|
Bot management |
Allowed bots |
Supported |
|
Bot threat intelligence |
Supported |
|
|
Intelligent bot algorithm |
Supported |
|
|
App protection |
Supported |
|
|
Response actions |
CAPTCHA and custom responses |
Supported |
Billing
WAF uses the Security Capacity Unit (SeCU) as its billing unit and supports both a pay-as-you-go model and payment via a resource plan. For more information, see Billing of WAF.
To purchase a WAF resource plan, click here.
Edge WAF parameter injection
When Edge WAF rules take effect, DCDN injects parameters into client requests for JavaScript verification, CAPTCHA challenges, and enhanced protection. The following table lists the injected parameters by protection type and injection location.
|
Protection type |
Injected parameters |
Injection location |
|
All WAF rules |
|
Cookie |
|
JavaScript verification |
|
Cookie, query string |
|
Dynamic token challenge |
|
Query string |
|
Slider CAPTCHA |
|
|
|
Bot management: web page/browser protection |
|
Cookie, query string |
|
Bot management: mini program protection |
|
Cookie |
|
Bot management: app protection |
|
|