What is ESA - Edge Security Acceleration overview - Edge Security Acceleration

Service architecture

ESA is a unified cloud service that protects and accelerates internet content, applications, data centers, enterprise networks, and AI workloads.

Global infrastructure

Through globally distributed POPs, ESA connects to major cloud providers, data centers, and carriers, using Anycast routing to minimize end-to-end latency.
Full-site traffic optimization and protection

ESA optimizes and protects traffic for websites, applications, and AI services at both the network and application layers. Enterprise plan users can also establish private network interconnection between on-premises data centers and the ESA edge, shielding data centers and data assets from exposure. To learn more about this VPC interconnection service, contact your account manager.
Serverless development platform

ESA provides a Node.js-compatible serverless environment on each POP, combining compute and KV storage capabilities. Developers can deploy websites and applications across the global edge network without managing infrastructure.
Comprehensive security and performance analytics

ESA collects and stores full-stack logs — DNS, network-layer, and application-layer — in compliance with regulations. Its near-real-time analytics system detects anomalous attacks within minutes.

Why choose ESA

Edge Security Acceleration (ESA) runs on a global infrastructure with 10,000+ ISP direct connections, 3,200+ acceleration nodes, and 180+ Tbps bandwidth. The ESA network delivers:

Low-latency access across the globe

ESA uses Anycast to direct traffic to a high-performance DPI engine, achieving global DNS resolution under 30 ms. A CDN mapping system routes users to the nearest optimal node, and smart routing ensures stable, millisecond-level end-to-end latency.

Multilayer native security protection

ESA provides native Anti-DDoS and Web Application Firewall (WAF) powered by proprietary machine learning algorithms that inspect every request. Global DDoS mitigation capacity exceeds 20 Tbps.

Integrated serverless edge capabilities

Each ESA POP integrates computing, storage, and networking in a serverless service. Deploy with Functions and Pages or images, with automatic elastic scaling and KV storage.

Real-time data monitoring and analytics

ESA provides near-real-time log collection and analytics with multi-level filtering for fine-grained O&M control.

Differences between ESA, DCDN, and CDN

ESA is a comprehensive upgrade that unifies CDN and DCDN into a single platform.

A faster experience

Feature	Description	ESA	DCDN	CDN
Cache acceleration	Caches static resources (images, audio, video, CSS) on edge nodes and optimizes routing for dynamic data such as API calls and database requests.	Supports static and dynamic resource cache acceleration. Supports cold resource cache retention. High-performance tiered caching.	Supports static and dynamic resource cache acceleration.	Supports static resource cache acceleration.
DNS hosting	ESA provides high-performance, secure DNS hosting with reduced DNS latency and DDoS attack mitigation.	Supported	Not supported	Not supported
Network optimization	ESA provides access optimization for Chinese mainland networks, using ESA nodes and the ESA network in regions such as Hong Kong (China) to resolve cross-border access issues. Available only for sites with the acceleration region set to Global (Excluding The Chinese Mainland). To change the region, switch the acceleration region of a site.	Supported	Not supported	Not supported
Layer 4 proxy	Provides Layer 4 TCP/UDP proxy acceleration and protection for scenarios such as real-time gaming and interactive audio/video.	Supports multiple ports for a single domain name. Supports both TCP and UDP ports for a single application. Supports session persistence. Integrates with Server Load Balancer to provide rich load balancing policy configurations and origin health checks.	Supports only one port for a single domain name. An application can use either TCP or UDP ports, but not both.	Not supported

More reliable protection

Feature	Description	ESA	DCDN	CDN
WAF protection	Built on WAF 3.0, identifies malicious traffic patterns and forwards only legitimate traffic to the origin.	More comprehensive WAF protection. Also supports custom mitigation policies and generating mitigation policies from data analytics.	Basic WAF protection.	Not supported
Anti-DDoS	Defends against high-volume DDoS attacks to protect online business continuity.	The Entrance, Pro, and Premium editions include basic platform-level DDoS protection. The Enterprise Edition supports up to Tbps-level protection.	Supports up to Tbps-level DDoS protection.	Not supported
Bot management	Identifies and blocks malicious or automated bots targeting your website or services.	Supports bot management through SDK integration for H5 pages and native Android and iOS apps.	Basic bot management.	Not supported
Origin Protection	Restricts origin access to edge node IPs only, blocking direct access from external IPs.	Supported	Not supported	Not supported
DNS protection	Defends against large-scale DNS attacks and provides stable resolution at ultra-high QPS.	Supports hundreds of millions of QPS.	Supports tens of millions of QPS.	Not supported

More flexible computing

Feature	Description	ESA	DCDN	CDN
Functions and Pages	A serverless service for deploying JavaScript code directly on edge nodes. Requests are processed at the nearest node, reducing latency.	Supports creating Pages frontend frameworks. Supports automatic elastic scaling. Supports Node.js. Supports real-time Log Monitoring.	Supports function deployment only.	Not supported
Edge storage	A Key-Value storage service on edge nodes. Combined with Functions and Pages, it enables same-node data reads for lightweight BaaS and API gateway deployments.	Supported	Supported	Not supported
Edge container	Containerized computing on edge nodes with global deployment and nearest-node scheduling. Eliminates server provisioning and scaling concerns, letting you focus on application development.	Supported	Not supported	Not supported

Easier configuration

Feature	Description	ESA	DCDN	CDN
Site access	One-stop site onboarding that integrates DNS, acceleration, computing, and security.	Accelerates the root domain and all its subdomains.	Accelerates specified domain names.	Accelerates specified domain names.
SSL/TLS certificate management	Issue certificates to clients using a shared certificate pool, reducing O&M complexity.	Supports issuing certificates to clients through the console. Free single-domain and wildcard domain name certificates. Supports certificate pool management.	Not supported	Not supported
Flexible plan management	Separates subscription plans from value-added services for straightforward cost control and flexible plan changes.	Supported	Not supported	Not supported
Powerful rules	Highly flexible rules for fine-grained, personalized configurations.	Supported	Not supported	Not supported
Traffic control	Edge nodes use the CDN mapping system and origin probing to distribute traffic across origin servers, reducing latency and improving availability.	Uses the smart routing system to optimize request paths. Includes a dedicated Server Load Balancer for origin health checks and fine-grained traffic distribution management. Supports creating a user waiting room, which provides a solution for handling high volumes of back-to-origin traffic.	Simple weight-based and primary/standby site configurations.	Simple weight-based and primary/standby site configurations.
Version management	Test, deploy, and roll back configuration changes based on custom request rules.	Supported	Not supported	Not supported

ESA as a reverse proxy

If you are evaluating whether ESA can replace a self-managed reverse proxy such as Nginx, the short answer is: ESA covers the core reverse proxy capabilities at the edge, but its architecture is fundamentally different.

Reverse proxy capabilities supported by ESA

ESA acts as an intermediary between clients and your origin servers across its globally distributed edge nodes. The following table compares common reverse proxy functions:

Capability	Nginx (self-managed)	ESA
Request proxying (Layer 7)	Supported	Supported — ESA edge nodes proxy HTTP/HTTPS requests to your origin with full header manipulation via rules.
SSL/TLS termination	Supported	Supported — managed certificate issuance, certificate pool, and automatic renewal.
Load balancing	Supported (round-robin, least-conn, ip-hash, etc.)	Supported — dedicated load balancer with weighted routing, health checks, failover, and session persistence.
Caching	Supported (proxy_cache)	Supported — static and dynamic cache acceleration with tiered cache and cache reserve.
Layer 4 (TCP/UDP) proxying	Supported (stream module)	Supported — multi-port TCP/UDP proxy with session persistence and origin health checks.
URL rewriting and redirects	Supported	Supported — configurable via the ESA rule engine.
Rate limiting	Supported (limit_req)	Supported — global rate limiting and DDoS mitigation at the edge.

Key differences from Nginx

Although ESA provides equivalent functionality at the request-handling level, the underlying architecture differs significantly:

Aspect	Nginx	ESA
Deployment model	Standalone software installed on your servers	Fully managed distributed edge platform with 3,200+ points of presence (POPs) worldwide
Operations	Self-operated — you manage installation, configuration, scaling, and failover	Managed service — Alibaba Cloud handles infrastructure, scaling, and high availability
Geographic coverage	Typically deployed in one or a few data centers	Global edge network with Anycast routing for automatic nearest-node access
Security	Requires separate integration of WAF, Anti-DDoS, and bot mitigation tools	Built-in multilayer security protection including native Anti-DDoS, WAF, and Bot Management
Scalability	Manual horizontal scaling behind a separate load balancer	Automatic elastic scaling across all edge nodes

When to use ESA instead of Nginx

ESA is a suitable replacement for a self-managed reverse proxy when:

Your users are geographically distributed and benefit from edge acceleration.
You need integrated security protection (DDoS, WAF, bot mitigation) without managing separate components.
You want to reduce operational overhead of maintaining and scaling proxy infrastructure.
Your application requires global load balancing with automatic failover and health checks.

For purely internal or single-region workloads where you need fine-grained local process control (such as custom Lua modules or complex local routing logic), a self-hosted Nginx instance may still be appropriate. In many architectures, ESA and a lightweight origin-side Nginx can coexist — ESA handles edge security and acceleration while Nginx manages local application routing at the origin.

Get started with ESA

Add a domain name to ESA to start using acceleration and protection.

Scenarios

Global business acceleration

Cross-border e-commerce, global games, and international applications face high access latency and security risks across regions.

Recommended solution: Use ESA NS setup mode with cross-border secure acceleration for regions outside the Chinese mainland.

Edge computing for high-concurrency applications

Real-time APIs, personalized recommendations, and IoT data processing benefit from edge-deployed computing logic that reduces back-to-origin latency.

Business security protection

Finance, gaming, and government sites that face frequent DDoS, CC attacks, or traffic abuse need strong edge protection for business continuity.

Recommended solution: Use ESA to prevent traffic abuse, and combine with CloudMonitor for automated origin protection.