All Products
Search
Document Center

Edge Security Acceleration:CDN, DCDN, and ESA: Feature comparison

Last Updated:Jun 24, 2026

ESA is a next-generation product independent of DCDN. To upgrade from DCDN or CDN, deploy on ESA directly and switch DNS. ESA requires no migration.

Key differences between ESA and xCDN

ESA differs from xCDN in three key areas: core capabilities, cost structure, and intelligent security.

Enhanced core capabilities and security

Feature

ESA

xCDN

CDN acceleration
Global edge caching with intelligent policies for faster content delivery.







Supported

Supported

Anti-fraud protection
Edge-native web application firewall (WAF) with one-click anti-fraud and intelligent rate limiting. Identifies and blocks malicious traffic.







Supported

Not supported

Free DigiCert certificates
Supports free auto-renewed certificates and custom uploads.







Supported

Not supported

Free DDoS protection
Paid ESA plans include basic, platform-level elastic DDoS protection within a defined threshold.







Supported

Not supported

Edge Functions and Pages
Free and paid modes. One-click site deployment with edge-hosted pages.







Supported

Not supported

Other
Includes rule engine, scheduled prefetch, real-time logs, and free DNS.







Supported

Not supported

Simple, transparent pricing

The following billing items apply only to ESA Pro and Premium plans. For the Enterprise plan, contact sales.

The xCDN column below covers both CDN and DCDN.

Billing item

ESA

xCDN

Traffic-based billing

Single global rate. The ESA Pro plan suits traffic-heavy services or those requiring anti-fraud protection.

Region-based billing

HTTPS request billing

No charge

For the Enterprise plan, contact us for custom pricing.

Charged

QUIC request billing

No charge

Charged

WAF request billing

No charge

For the Enterprise plan, contact us for custom pricing.

Charged

Real-time log requests

No charge

Charged

Blocked traffic and requests

No charge

Charged

Smarter security

ESA adds four security capabilities beyond xCDN:

  • AI-driven threat detection: Identifies and blocks network threats automatically.

  • Real-time attack visualization: Displays attack patterns and defense outcomes in real time.

  • Intelligent rate limiting: Detects and throttles anomalous traffic automatically.

  • One-click anti-fraud: Millisecond-level response; protection takes effect instantly.

Product migration: Feature comparison

ESA is a complete redesign of DCDN and CDN. When you upgrade from DCDN or CDN to ESA, the following tables map DCDN and CDN features to their ESA counterparts to help you get started with ESA.

Basic configuration

Feature

Description

CDN

DCDN

ESA

Modify acceleration region

Changes service scope by switching the acceleration region.

Modify acceleration region

Switch acceleration region

Switch the acceleration region for a site

Origin server configuration

Configure origin servers: OSS domains, IP addresses, origin domains, and Function Compute domains.

Configure an origin server

Configure an origin server

Add DNS records to configure various types of origin servers for your site.

IPv6 switch

Enables IPv6 for requests over various links.

IPv6 configuration for client requests.

IPv6 configuration for client requests.

ESA lets you configure end-to-end IPv6 access.

IPv6 back-to-origin configuration for back-to-origin requests.

IPv6 back-to-origin configuration for back-to-origin requests.

Domain name management

Feature

Description

CDN

DCDN

ESA

Add, delete, and query domain names

Add, delete, and query domain names.

Domain name management

Modify basic domain configuration

Domain name migration

Migrate domain names across accounts.

Migrate a CDN domain name across accounts

Migrate a DCDN domain name across accounts

Migrate a domain by adding it to ESA.

Verify domain name ownership

You must verify ownership when adding a domain name.

Verify domain name ownership

Verify domain name ownership

Back-to-origin configuration

Feature

Description

CDN

DCDN

ESA

origin HOST

Customizes the Host header in back-to-origin requests.

Configure a default origin HOST

Configure a default origin HOST

Specify an origin HOST for a specific origin server

origin protocol

Specifies the protocol POPs use for back-to-origin requests.

Configure the origin protocol

Configure protocol-follow-origin for static content

back-to-origin for private Alibaba Cloud OSS bucket

Grants back-to-origin access to all resources in a private Alibaba Cloud OSS bucket.

back-to-origin to a private OSS bucket

back-to-origin to a private OSS bucket

Use ESA to accelerate access to OSS resources

origin SNI

Required when your origin hosts multiple HTTPS domains on one IP to ensure the correct SSL certificate is presented during TLS handshake.

Configure origin SNI

Configure a specific origin SNI

Origin SNI

back-to-origin HTTP request timeout

Sets the maximum wait time for a POP to receive a response from the origin.

Back-to-origin HTTP request timeout

Back-to-origin HTTP request timeout

Back-to-origin HTTP request timeout

back-to-origin HTTP request header

Adds, deletes, or modifies HTTP headers in back-to-origin requests.

Configure back-to-origin HTTP request headers

Configure custom back-to-origin HTTP request headers

Use a transform rule to modify request headers.

back-to-origin HTTP response header

Modifies HTTP response headers from the origin.

Modify inbound response headers

Modify inbound response headers

Use a transform rule to modify response headers.

Common Name whitelist

Allows back-to-origin requests to succeed when the origin SNI does not match the certificate Common Name.

Common Name whitelist

Configure a Common Name whitelist

Not supported

follow 301/302 redirect

POPs automatically follow 301/302 redirects from the origin, reducing round trips.

Configure follow 301/302 redirect

Configure follow 301/302 redirect

Configure follow 301/302 redirect

back-to-origin URL rewrite

Rewrites the request URL before forwarding to the origin.

Rewrite a back-to-origin URL

Rewrite a back-to-origin URI

Use a transform rule to rewrite a URL.

back-to-origin parameter rewrite

Modifies query string parameters in a back-to-origin URL.

Rewrite back-to-origin parameters

Rewrite back-to-origin parameters

origin group

Define origin groups with multiple primary and secondary origin addresses.

Configure an origin server

Configure an origin server

Configure an origin group

conditional origin

Routes requests to a specific origin server if they match defined rule conditions.

Configure a conditional origin

Not available

Configure DNS records for different conditions in an origin rule to implement conditional origin.

Cache configuration

Feature

Description

CDN

DCDN

ESA

Cache TTL

Controls how long POPs cache origin resources.

Configure a cache TTL for CDN

Configure a cache TTL

Status code TTL

Caches specific HTTP status codes for a set TTL, reducing origin load.

Configure a status code TTL

Configure a status code TTL

Configure the cache TTL for status codes

Set HTTP response header

Adds or modifies HTTP response headers at the POP to control browser caching, CORS, and other behaviors.

Modify outbound response headers

Modify outbound response headers

Use a transform rule to modify outbound response headers.

Custom error page

Returns a custom page instead of the default error page when content is not found or an error occurs.

Configure a custom page

Configure a custom page

Implement this feature by adding a custom edge function.

Request URL rewrite

Rewrites incoming request URLs to a new path.

Configure an access URL rewrite rule

Configure a URI rewrite rule

Use a rule to configure request redirection.

Custom cache key

Maps similar requests to a single cache key to improve cache hit ratio.

Custom cache key

Custom cache key

Custom cache key

Shared cache / request collapsing

Allows domains under the same account to share cache space, improving hit ratio.

Configure shared cache

Not supported

Not supported

HTTPS configuration

Feature

Description

CDN

DCDN

ESA

HTTPS certificate

Encrypts requests between clients and POPs.

Configure an HTTPS certificate

Configure an HTTPS certificate

Configure edge certificates

HTTP/2 settings

Reduces latency through binary framing, multiplexing, and header compression.

Configure HTTP/2

Configure HTTP/2

Enable HTTP/2

Force redirect

Automatically redirects all client HTTP requests to HTTPS.

Configure protocol redirection

Configure force redirect

Force HTTPS

TLS versioning

Selects TLS versions to balance security with backward compatibility for older clients.

Configure TLS versioning and cipher suites

Default TLS cipher suites supported by DCDN

Configure TLS cipher suites and protocol versions

HSTS

Improves security by forcing clients to connect to POPs exclusively over HTTPS.

Configure HSTS

Configure HSTS

Configure HSTS

OCSP Stapling

POPs cache certificate revocation status, eliminating client-side OCSP queries during TLS handshakes.

Configure OCSP Stapling

Configure OCSP Stapling

Configure OCSP Stapling

Access control

Feature

Description

CDN

DCDN

ESA

referer hotlink protection

Filters requests by Referer header using a blacklist or whitelist. Unauthorized requests receive a 403 error.

Configure referer hotlink protection

Configure referer hotlink protection

ESA implements a referer blacklist/whitelist using WAF custom rules.

url authentication

Validates requests using an encrypted URL string and timestamp to prevent unauthorized access.

Configure url authentication

URL authentication configuration

ESA implements this by configuring an edge function based on templates for authentication methods A, B, and C.

ip blacklist/whitelist

Filters requests by IP blacklist or whitelist to restrict traffic sources and block malicious scraping and attacks.

Configure an ip blacklist/whitelist

Configure an ip blacklist/whitelist

ESA implements an ip blacklist/whitelist using WAF custom rules.

user-agent blacklist/whitelist

Filters requests by User-Agent blacklist or whitelist to restrict access from specific clients.

Page optimization

Configure a user-agent blacklist/whitelist

ESA implements a user-agent blacklist/whitelist using WAF custom rules.

remote authentication

Forwards requests to a specified authentication server for verification.

Configure remote authentication

Not supported

ESA implements this by adding a custom edge function.

Performance optimization

Feature

Description

CDN

DCDN

ESA

html optimization

Strips comments and whitespace from HTML, JavaScript, and CSS to reduce file size.

html optimization

html optimization

Implemented by adding a custom edge function.

Gzip compression

Compresses files to reduce transfer size and bandwidth.

Gzip compression

Gzip compression

Brotli compression

Often achieves better compression than Gzip. Edge nodes compress resources before delivery.

Brotli compression

Brotli compression

Ignore parameters

Edge nodes ignore the query string (after ?) when generating a cache key, improving hit ratio.

ignore parameters

ignore parameters

Image processing

Performs on-the-fly image operations (resize, crop, rotate, compress) at the edge.

image processing

image processing

Set image transform

Video features

Feature

Description

CDN

DCDN

ESA

Range back-to-origin

Adds a Range header to back-to-origin requests so the origin returns only the requested portion, improving efficiency and cache hit ratio.

Configure range back-to-origin

Configure range back-to-origin

Origin rules

Video seeking

Lets users jump to any point in an audio or video stream.

Configure video seeking

Configure video seeking

Configure video seeking

Listen to video

Extracts and delivers only the audio track from a video file.

Configure listen to video

Not supported

Not supported

Audio or video preview

Delivers a specified duration of audio or video for non-subscriber previews.

Configure audio or video preview

Not supported

Rewrite standard M3U8 encryption

Modifies M3U8 manifest files for HLS by dynamically adding encryption parameters after a specific tag.

Configure rewrite standard M3U8 encryption

Not supported

Resource monitoring

Feature

Description

CDN

DCDN

ESA

Bandwidth and traffic

Bandwidth and traffic data for an accelerated domain, queryable by region, carrier, and protocol.

resource monitoring

resource monitoring

Number of requests/QPS

Request count and QPS for an accelerated domain across different dimensions.

Http status code

HTTP status codes returned for an accelerated domain.

Back-to-origin statistics

Back-to-origin bandwidth and traffic for an accelerated domain.

In Cache Analysis, filter by Service Provider = origin to view back-to-origin statistics.

Http status code (back-to-origin)

HTTP status codes from the origin for back-to-origin requests.

Hit ratio

Byte and request hit ratios for an accelerated domain.

Not applicable

Real-time data monitoring

Real-time bandwidth, traffic, request count, and QPS for an accelerated domain.

real-time monitoring

real-time monitoring

Real-time back-to-origin monitoring

Real-time back-to-origin bandwidth and traffic for an accelerated domain.

In Cache Analysis, filter by Service Provider = origin to view back-to-origin statistics.

Real-time quality monitoring

Real-time request hit ratio, byte hit ratio, and HTTP status codes for an accelerated domain.

Operations reports

Feature

Description

CDN

DCDN

ESA

PV/UV

View PV/UV metrics for a domain over a specified time range.

Customize and subscribe to operations reports

Customize and subscribe to operations reports

Top client IPs

Top client IPs for a domain and date, ranked by traffic or request count.

Regions and carriers

User visit distribution by region and carrier. Covers the Chinese mainland, Hong Kong (China), Macao (China), Taiwan (China), and overseas.

Popular referers

Top referers by traffic volume, traffic share, request count, and request share for hotlink protection analysis.

Popular URLs

Top URLs by traffic or requests for a domain, filtered by status code.

Popular URLs (back-to-origin)

Top back-to-origin URLs by traffic or requests for a domain, filtered by status code.

Domain name ranking

Ranks domains by traffic share, traffic volume or bandwidth peak, peak time, and total requests.

Subscribe to operations report tasks

Subscribe to customizable reports emailed to a specified address.

Purge and prefetch

Feature

Description

CDN

DCDN

ESA

URL purge

Purges a cached resource by URL. The next request retrieves the latest version from the origin.

Purge and prefetch resources

Purge and prefetch resources

Purge cache by URL

Directory purge

Purges all cached resources within a directory. The next requests retrieve latest versions from the origin.

Purge cache by directory

Regex purge

Batch-purges resources matching a regular expression.

Use these purge policies instead:

URL prefetch

Prefetches origin resources to edge nodes before user requests, reducing origin load.

Prefetch cache

Tools

Feature

Description

CDN

DCDN

ESA

IP address query

Checks whether an IP address belongs to an acceleration node.

Detect an IP address

Detect an IP address

IP geolocation query

URL diagnostic tool

Troubleshoots webpage loading failures or errors.

Self-service diagnostic tool

Not supported

Not supported

Usage and billing queries

Feature

Description

CDN

DCDN

ESA

Usage query

Query usage data by traffic, bandwidth, HTTPS requests, and billing region.

Usage query

Usage query

Query usage

Usage summary

View a usage summary across all domain names for the product.

Usage summary

Not supported

Usage summary

Export summary

Export total usage data across all domain names for the product.

Export summary

Not supported

Export summary

Export details

Export per-item usage details across all domains, filterable by domain, time, and account.

Export details

Not supported

Query and export details

Resource plan query

View resource plan details: total amount, remaining amount, and expiration date.

Resource plan management

Query resource plan usage

ESA is a subscription service and does not use resource plans.

Billing method query

View your current billing method.

Bill query

Bill query

View your current plan level in Websites or Query usage.

Change billing method

Change your billing method.

Change the billing method

Change the billing method

Upgrade plan

Other features

Feature

Description

CDN

DCDN

ESA

Traffic cap

Caps maximum bandwidth for a domain to prevent losses from sudden traffic surges.

Configure a traffic cap

Not supported

Traffic cap

EdgeScript

Custom scripts for flexible edge logic when standard console settings are insufficient.

Use EdgeScript through the console

Use EdgeScript through the console

Edge Function Quick Start

QUIC protocol switch

Reduces connection and transmission latency while maintaining standard security.

Configure the QUIC protocol

What is the QUIC protocol

Enable HTTP/3 (QUIC)

EdgeScript execution status

View the execution status of your EdgeScript.

EdgeScript monitoring

Use edge functions through the console

EdgeScript exceptions

View exceptions and error codes from EdgeScript execution.

EdgeScript monitoring

Troubleshooting and FAQ

Rules

Conditional logic via a graphical interface to match request parameters and apply configurations.

Rules

Not supported

Use Rules.

Offline log download

Hourly access logs per domain, downloadable for the past 30 days.

Quick Start

Offline log field description

Download offline logs

Transfer offline logs using Function Compute

Automatically transfers new offline logs to OSS via a preconfigured Function Compute function.

Transfer offline logs by using Function Compute

Not supported

Achieve this by creating a real-time log delivery task.

Real-time log delivery

Delivers real-time logs from accelerated domains to SLS for monitoring and troubleshooting.

Deliver real-time CDN logs to SLS to analyze user access data

Configure real-time log delivery

Data statistics

Aggregated traffic, performance, and user access statistics.

User access log analysis report