Edge Security Acceleration (ESA) provides a unified rules engine that lets you create and deploy conditional rules across different features — including cache, redirection, compression, origin fetch, and WAF (Web Application Firewall) — all using the same syntax and configuration logic. Instead of configuring each feature separately, you define rule conditions that identify parameters in user requests and determine whether a configuration applies. This gives you flexible and precise control over how ESA handles traffic to your site.
Before you begin
Before you create rules, make sure you meet the following requirements:
You have an Alibaba Cloud account with ESA activated.
You have added at least one site to the ESA console and completed DNS configuration.
You can access the ESA console.
ESA rules
Rules let you create and deploy conditional logic across different features — cache, redirection, compression, origin fetch, and WAF — using the same syntax.
Each rule is built from three components:
Match fields — the request attribute to evaluate (for example, hostname, URI path, or country/region).
Match operators — how the field is compared to the value (for example, equals, does not equal, or contains).
Match values — the specific value to compare against (for example,
www.example.comor/content).
Note: For a specific feature, if you add configurations at both the global level and the rule level, the rule configuration takes precedence when a user request matches the rule conditions. A single rule configuration, which includes rule conditions and the feature configuration, is limited to 4 K characters. All configuration information for a site, including global configurations, rule configurations, and certificate configurations, is limited to 512 K characters. This limit excludes rule configurations for security protection. A rule name is limited to 128 characters.
Rule templates
ESA provides rule configuration templates for common use cases. Click a template to quickly create a rule without building conditions from scratch.
After you add a rule, ESA matches and executes rules sequentially based on the rule execution priority each time a user requests a resource.
Procedure
The following example shows how to use the Redirect to a New URL template to create a redirection rule.
In the ESA console, choose Websites, and in the Website column, click the target site.
In the navigation pane on the left, choose Rules > Rule Template.
On the Rule Templates page, select Redirect to a New URL and click Create in the upper-right corner.
In the custom rule settings, enter the URI path to redirect, such as
/esa.jpg.In the URL Redirect section, enter the full redirection URL, such as
https://www.aliyun.com.Test by visiting
http://yourDomain/esa.jpg. A 301 status code confirms the redirection is active.
Use rules for WAF protection
WAF custom rules let you restrict access by geographic location. The following example blocks all traffic from outside the Chinese mainland.
Example: Block all countries and regions except the Chinese mainland
What this rule does:
|
Match field |
Operator |
Match value |
Action |
|
Country/Region |
does not equal |
Chinese Mainland |
Block |
Expression: (ip.geoip.country ne "CN")
Configure rule conditions
In the ESA console, choose Websites, and in the Website column, click the target site.
In the navigation pane on the left, choose Security > WAF > Custom Rules > Create Rule.
Enter a Rule Name, such as
rule-01.From the Match Type drop-down list, select Country/Region.
From the Operator drop-down list, select does not equal.
From the Match Value drop-down list, select Chinese Mainland.
From the Action drop-down list, select Block, and click OK.
To block a single country or region instead, select equals from the Operator drop-down list, then follow the same steps.
Verify the blocking rule
Send a request from outside the Chinese mainland — for example, from Singapore. The default block page and a 403 status code are returned.
Set a redirection rule
Use a redirection rule to automatically forward visitors from an old URL to a new one — for example, when you move content to a different location.
Example: Redirect requests from one URL to another
What this rule does:
|
Match field |
Operator |
Match value |
|
Hostname |
equals |
|
|
URI Path |
equals |
|
Requests matching both conditions are redirected to https://www.example.com/image/image2.jpg.
Configure rule conditions
In the ESA console, choose Websites, and in the Website column, click the target site.
In the navigation pane on the left, choose Rules > Redirect Rules > Create Rule.
Enter a Rule Name, such as
rule-02.From the Match Type drop-down list, select Hostname.
From the Operator drop-down list, select equals.
In the Match Value text box, enter
www.example.com.Click And to add a second condition. From the Match Type drop-down list, select URI Path.
From the Operator drop-down list, select equals.
In the Match Value text box, enter
/image1.jpg.In the URL Redirect section, enter the destination URL:
https://www.example.com/image/image2.jpg.
Verify the redirection
Access the original URL. The request is redirected to https://www.example.com/image/image2.jpg, and the 301 status code confirms the redirection is active.
Set a browser cache time-to-live rule
Use a browser cache TTL rule to control how long browsers cache your content for specific resources — balancing performance with content freshness.
Example: Cache resources for 1 hour if the hostname is www.example.com and the URL path is /content
What this rule does:
|
Match field |
Operator |
Match value |
|
Hostname |
equals |
|
|
URI Path |
equals |
|
Browser cache TTL: 1 hour (results in cache-control: max-age=3600)
Configure rule conditions
In the ESA console, choose Websites, and in the Website column, click the target site.
In the navigation pane on the left, choose Rules > Cache Rules > Create Rule.
Enter a Rule Name, such as
rule-03.From the Match Type drop-down list, select Hostname.
From the Operator drop-down list, select equals.
In the Match Value text box, enter
www.example.com.Click And to add a second condition. From the Match Type drop-down list, select URI Path.
From the Operator drop-down list, select equals.
In the Match Value text box, enter
/content.
Configure the browser cache TTL
Select Use Custom TTL. Enter 1 and select Hours as the unit.
Verify the browser cache TTL
Test access to the file. The response header cache-control: max-age=3600 confirms the browser cache TTL is set to 1 hour.
