ESA limitations - Edge Security Acceleration - Alibaba Cloud Documentation Center

Before you add a domain name to Alibaba CloudESA, you must understand the Alibaba CloudESA requirements and limitations for accelerated domains to prevent any issues.

Item	Description
Burst bandwidth and QPS throttling rules	if you expect ESA to handle burst bandwidth or a QPS surge for events like stress tests, promotions, or major launches, request additional capacity by contacting your Alibaba Cloud account manager or contact us at least 3 business days in advance. For major holidays or events, such as the Spring Festival Gala or Double 11, submit your request at least 1 month in advance. If your request is approved, service availability is guaranteed up to the agreed-upon capacity. Without an approved increase, Alibaba Cloud may throttle traffic to ensure network stability. Throttling is not guaranteed and depends on your domain's traffic patterns and the burst's scale. Alibaba Cloud is not liable for any resulting availability issues. Failure to secure prior approval for burst capacity may lead to the following issues: A sudden increase in bandwidth may trigger ESA throttling rules. For more information, see Bandwidth limit description. A sudden surge in QPS may trigger ESA DDoS protection rules. Each plan has a different maximum protection capacity. If traffic exceeds this limit, ESA may route it to a specific set of edge nodes, impacting access speed.
Potential risks of domain attacks and traffic abuse	By default, ESA does not provide access control or security protection. If your domain experiences a malicious attack or traffic abuse, the resulting surge in bandwidth and traffic can lead to unexpectedly high charges. Charges that result from malicious attacks or traffic abuse are non-refundable. To mitigate this risk, see High-bill risk alert for recommended mitigations.
Site	Format requirements: The domain name must be 1 to 67 characters long. The domain name must contain only lowercase letters (`a-z`), digits (`0-9`), and hyphens (`-`). For example, `example.com`. Unsupported characters include Chinese characters, uppercase English letters`(A-Z)`, and special characters other than the hyphen`-`. In addition, a hyphen`-`cannot appear consecutively, be used alone, or be the first or last character. If a domain name contains Chinese characters, you must complete the ICP filing for the domain in its Chinese format. Then, use a third-party Punycode tool to convert the Chinese domain name to its Punycode equivalent (for example, `xn--fiq**.xn--eq`) and enter the converted domain name. ICP filing and compliance requirements: ICP filing: If your acceleration region is set to Global or Chinese Mainland**, you must complete an ICP filing for your domain name, regardless of the origin server's location. We recommend that you use the Alibaba Cloud ICP Filing System for this purpose. Before you proceed with the ICP filing, see Check the server for ICP filing to complete the required preparations and checks. Content compliance: The content that you accelerate must be legal and comply with ESA service policies. For more information, see the Security violations and prohibited content section in this topic.
Acceleration region restrictions	If a Site's acceleration region is set to Global (Excluding the Chinese Mainland), ESA blocks user requests to its edge nodes in the Chinese Mainland. If a Site's acceleration region is set to Chinese Mainland, ESA blocks user requests to its edge nodes outside the Chinese Mainland.
IoT card access restrictions	In accordance with regulations from the Ministry of Industry and Information Technology (MIIT) of the People's Republic of China (Notice No. 1173, 2020), ESA does not provide acceleration in the Chinese Mainland for devices that use an IoT card. As a result, these devices may fail to connect to ESA edge node IP addresses.
Security violations and prohibited content	All domains added to ESA are subject to content review. ESA does not support domains that host content in the following categories, including but not limited to: Sites that are inaccessible or contain no substantive content Private game servers Websites for multiplayer role-playing games and online card games Websites that distribute unauthorized copyrighted material, such as pirated software, novels, videos, or comics Peer-to-peer (P2P) lending websites Lottery websites Websites for unlicensed hospitals or the sale of unregulated pharmaceuticals Content related to pornography, illegal drugs, or gambling Note You are solely responsible for risks arising from accelerating prohibited content. The ESA system regularly reviews all domain content and will immediately suspend or block any domain found in violation. In severe cases, Alibaba Cloud will terminate your ESA service, and all associated domains will be taken offline.
Files	File cache ESA edge nodes can cache files up to 500 GB if the origin server provides a cacheable HTTP response header. File upload The default maximum size for a file upload to an origin server through ESA is 300 MB. You can change this limit by Maximum upload size.
URL and HTTP request header size limits	For HTTP/2.0 connections: The default Nginx parameter `http2_max_field_size` is 32 KB. The size of a single HTTP request header or a single URL cannot exceed 32 KB. Requests that exceed this limit return a 414 status code. The default Nginx parameter `http2_max_header_size` is 128 KB. The total size of all HTTP request headers plus the URL cannot exceed 128 KB. Requests that exceed this limit return a 400 status code. For HTTP/1.1 connections, ESA configures `large_client_header_buffers` with `number=4` and `size=64 KB`. Therefore, a single HTTP request header or URL cannot exceed 64 KB, and the total size of all headers plus the URL cannot exceed 256 KB (4 × 64 KB). Requests that exceed the single-item limit return a 414 status code, while requests that exceed the total size limit return a 400 status code.
Origin server HTTP response header size limit	The total size of the HTTP response header from an origin server to an ESA edge node cannot exceed 32 KB. If a response header exceeds this limit, ESA returns a 502 status code.
Gzip and Brotli compression	ESA applies Gzip and Brotli compression only to origin server files between 1 KB and 10 MB in size.
Ports	ESA edge nodes accept traffic on the following ports: HTTP ports: 80, 8080, 8880, 2052, 2082, 2086, and 2095. HTTPS ports: 443, 2053, 2083, 2087, 2096, and 8443. By default, ESA caches static requests only on ports 80, 443, and 8080. To enable caching on other supported ports, configure a Cache Rule and use the Custom Port Cache feature.
TCP connection timeout between a client and an ESA edge node	The default value is 30 seconds. If the idle time of a TCP connection exceeds 30 seconds, the ESA node actively terminates the connection.
API call limit	ESA limits calls to the `CreateSite` and `CreateCustomHostname` APIs to 100 per user per hour.
Site configuration size limit	The total size of all configuration information for a site, including global configurations, rule configurations, and certificate configurations, is limited to 512 K characters. This limit excludes rule configurations for security protection.