All Products
Search
Document Center

Edge Security Acceleration:User Guide

Last Updated:Oct 15, 2025

You can manage Dynamic Content Delivery Network (DCDN) or Edge Security Acceleration (ESA) resources in the console.

doutub_gifEdge Security Acceleration (ESA) User Guide

doutub_gifDynamic Content Delivery Network (DCDN) User Guide

Edge Security Acceleration (ESA)

Features

Feature

Description

References

Website management

Version management

The version management feature of Edge Security Acceleration (ESA) allows you to maintain different versions for custom website configurations and test, deploy, and roll back configuration changes.

Version management

Analytics and logs

  • Edge Security Acceleration (ESA) logs requests that pass through ESA points of presence (POPs) and analyzes these logs to help you troubleshoot issues, check the impact of updated configurations, and monitor metrics.

  • Edge Security Acceleration (ESA) logs requests to your website. It collects and aggregates the logs generated by each module for you to view. You can use these logs to troubleshoot faults, generate monitoring metrics, and debug or test network connectivity between clients and your website.

Analytics and logs

DNS

Edge Security Acceleration (ESA) provides a powerful and flexible Domain Name System (DNS) service. You can select NS or CNAME to set up your domain when you add your website to ESA, and then manage your DNS records through ESA. After connecting your website to ESA, ESA provides static and dynamic acceleration, security protection, edge computing, and other services, improving access experience and security for your website.

DNS

SSL/TLS

This topic introduces the basic concepts of SSL/TLS protocols, their application in HTTPS encryption, and the role of related certificates.

SSL/TLS

Security protection

  • ESA combines edge Web Application Firewall (WAF) capabilities with rule features to provide fine-grained scrubbing and management of back-to-origin traffic.

  • ESA provides two modes, Smart Mode and Professional Mode, to meet the security protection requirements of different business scenarios.

  • ESA monitors traffic in real time to detect attack patterns, such as SYN floods, ACK floods, and CC attacks. When unusual traffic is detected, ESA responds quickly by automatically blocking malicious data while allowing legitimate traffic to pass through. This process ensures business continuity and stability.

  • Whitelist ESA node IP addresses in your origin server's firewall rules. This ensures that only traffic from verified ESA IP addresses can access your origin server, thereby protecting your business.

Speed and network

  • Edge Security Acceleration (ESA) provides the image transformations feature. You can convert image formats and quality, crop, resize, and cache images from the origin server. This accelerates image retrieval and reduces origin traffic.

  • Edge Security Acceleration (ESA) provides features such as network access optimization, IPv6 support, as well as WebSocket and gRPC connections to optimize cross-region network performance and user experience.

Caching

After you add a website to Edge Security Acceleration (ESA), ESA points of presence (POPs) determine whether to cache resources that are requested by clients based on configured cache rules. After a POP caches a file, when clients request the file, the POP responds the file to clients without retrieving it from the origin server over a long route. This reduces latency and improves load times. If the requested file does not exist on the POP or has expired, the POP asks the origin server for the most recent file.

Rules

Edge Security Acceleration (ESA) lets you create rules to customize settings for incoming requests. To apply custom settings like transform, redirect, or cache to specific requests, or to gain detailed control over security and traffic management, use syntax and configuration logic to filter requests based on specific characteristics and configure the appropriate features.

Traffic

  • This topic introduces what smart routing is, how it is billed, and how to enable the feature in the ESA console.

  • When many users make origin fetch requests, a waiting room can prevent traffic surges from causing your origin server to go down. Use the waiting room to manage these users, limit the number of concurrent users on your origin server, and provide an orderly queue for waiting users.

  • Load balancing distributes traffic among origin servers according to traffic steering policies to reduce latency and improve service availability.

Layer 4 acceleration

If your application establishes connections with the origin server over Transmission Control Protocol (TCP) or User Datagram Protocol (UDP), you can enable the TCP/UDP proxy feature to improve application performance and security. Common TCP or UDP-based scenarios include real-time combat games and real-time interactive audio and video streaming.

Edge computing

Edge function

Edge Routine is a serverless runtime environment that allows you to write JavaScript code and deploy and execute it on Alibaba Cloud points of presence (POPs) worldwide. Edge Routine supports ES6 syntax and standard Web Service Worker APIs. With Edge Routine, user requests can be responded to and processed by the POP that is closest to users. This significantly reduces latency, accelerates response, and enhances user experience.

Functions and Pages

Edge container

Edge Container provides elastic, easy-to-maintain computing resources based on containerized applications. Edge Container implements global deployment and proximity-based scheduling on points of presence (POPs) all over the world. This simplifies protocol processing and reduces response latency. You do not need to purchase server resources or worry about application scaling and O&M. This allows you to focus on application development rather than underlying infrastructure management.

Edge container

Edge storage

Edge KV is a key-value pair storage service available at points of presence (POPs). Data written to Edge KV is quickly synchronized globally across POPs. Edge Routine (ER) allows for fast reading of Edge KV data from the same POP. Use Edge KV with ER to deploy lightweight Blockchain as a Service (BaaS) and API gateway services.

Edge storage

Analytics and logs

Account analytics

This topic explains how ESA account analytics provides visualized analysis of different metrics from all the websites under your account and walks you through how to use it.

Logs

Edge Security Acceleration (ESA) logs requests to your website. It collects and aggregates the logs generated by each module for you to view. You can use these logs to troubleshoot faults, generate monitoring metrics, and debug or test network connectivity between clients and your website.

Offline logs

Real-time logs

Instant logs

Global settings

Groups

Global Settings allows you to create IP addresses or CIDR block lists. You can use the feature to implement batch association and centralized management of Web Application Firewall (WAF) and bot policies, preventing repeated settings of multiple rules. List changes are automatically synchronized to all associated policies to ensure global policy consistency.

Groups

Scenario-specific policies

The scenario policies allow you to address business peak situations such as new game launches and e-commerce promotions. With Major Event templates, DDoS protection policies are adjusted automatically. This adjustment ensures dynamic adaptation to traffic fluctuations during the designated activity period, reduces false positives for normal users, and maintains continuous business operations during high-concurrency periods.

Manage scenario-specific policies

Custom pages

By default, pages with an Edge Security Acceleration (ESA) identifier and the 403 error code are returned for requests that are blocked by ESA. If you want to use a personalized page with a business identifier, you can create a custom error page.

Configure a custom page

Tools

IP geolocation

After you add a website to Edge Security Acceleration (ESA), you can use the IP geolocation feature to check whether the actual IP address that clients request to access belongs to an ESA point of presence (POP), therefore verifies whether acceleration takes effect.

IP geolocation

Billing management

Plan management

You can query your plans, such as the plan type, status, expiration time, and associated websites, to better manage the plans.

Choose a plan that is right for you

Usage query

When using Edge Security Acceleration (ESA) for your websites, you can query the traffic usage for each individual website or for all websites covered by a plan. This data can help you analyze traffic patterns and make informed decisions accordingly.

Query usage

Dynamic Content Delivery Network (DCDN)

Features

Feature

Description

References

Content delivery service

Domain name management

Alibaba Cloud Dynamic Content Delivery Network (DCDN) provides safe and secure acceleration services for content and computing workloads. The initial setup for DCDN requires only a few simple steps. This topic describes how to use DCDN.

Business monitoring

The resource monitoring feature collects data including network traffic, bandwidth, the number of requests, cache hit ratio, and HTTP status codes based on the region and Internet service provider (ISP) of client IP addresses. You can make informed business decisions and optimize Dynamic Content Delivery Network (DCDN) resource management based on the collected monitoring data.

The real-time monitoring feature in Dynamic Content Delivery Network (DCDN) collects data at an interval of 1 minute. You can query data transfer, bandwidth usage, and origin fetch statistics in the last 1 minute and earlier. You can query data in the last 7 days. The maximum time range per query is 24 hours. Real-time monitoring allows you to detect anomalies in network traffic and locate errors at the earliest opportunity.

Management tools

After you add an origin server to Dynamic Content Delivery Network (DCDN), you can use the IP address check feature to check whether the IP address that the client accesses belongs to a POP and determine whether the acceleration takes effect.

Detect IP addresses

Edge security

DDoS mitigation

Accelerated domain names that are under DDoS attack may be added to a sandbox and become unavailable for a period of time. To prevent service interruptions, you can configure DDoS mitigation for domain names that are vulnerable to attacks or mission-critical. This way, Dynamic Content Delivery Network (DCDN) can detect and respond to DDoS attacks promptly and shield the domain names against attacks.

DDoS mitigation feature

WAF protection

Dynamic Content Delivery Network (DCDN) is integrated with Web Application Firewall (WAF) to identify traffic patterns and filter out and block malicious requests.

Edge WAF protection (new)

Data center

Operations reports

Operations reports allow you to query offline analytics data of accelerated domain names in specific time periods. You can learn about the status of accelerated domain names and your business by analyzing the data. Operations reports track data up to 60 days. Please download the data if you want to analyze information that exceeds 60 days.

Customize and subscribe to operations reports

Log management

The log management service is used to analyze Dynamic Route for CDN (DCDN) logs to troubleshoot issues in a timely manner and improve service quality. This topic describes the log management service and features provided by DCDN.

Log Management

Edge computing service

Edge Routine

EdgeRoutine is a serverless runtime environment that allows you to write JavaScript code and deploy and execute it on Alibaba Cloud points of presence (POPs) worldwide. EdgeRoutine supports ES6 syntax and standard Web Service Worker APIs. With EdgeRoutine, user requests can be responded to and processed by the POP that is closest to users. This significantly reduces latency, accelerates response, and enhances user experience.

Edge storage

Points of presence (POPs) provide the edge storage service EdgeKV, which is based on key-value pairs. After you write data to EdgeKV, the data can be automatically synchronized to POPs around the world. EdgeRoutine (ER) can read and use the key-value pairs on the same POP. You can use EdgeKV together with ER to deploy lightweight Blockchain as a Service (BaaS) services and API gateway services.

Edge storage

IP application acceleration

Layer 4 acceleration

IP Application Accelerator (IPA) is an acceleration feature that is offered by Alibaba Cloud DCDN. IPA provides high-performance Layer 4 acceleration for traffic over TCP and UDP. It ensures low latency and high service stability for real-time interactions such as messaging in social media, data synchronization in online gaming, online education, and financial transactions.