All Products
Search

This Product

    Web Application Firewall:Configure HTTP flood protection

    Document Center

    Web Application Firewall:Configure HTTP flood protection

    Last Updated:Apr 23, 2026

    After you add a website to WAF, HTTP flood protection is enabled by default. This feature blocks HTTP flood attacks that target page requests and returns a 405 error page for blocked requests. You can customize the protection policy to meet your business requirements.

    Prerequisites

    • You have activated a Web Application Firewall instance.

    • Your website has been added to WAF. For more information, see Tutorials.

    Procedure

    1. Log on to the Web Application Firewall console.

    2. In the top menu bar, select the resource group and region for your Web Application Firewall instance (Chinese Mainland or Outside Chinese Mainland).

    3. In the left navigation pane, choose Protection Config > Website Protection.

    4. On the Website Protection page, switch to the domain name to configure.切换域名

    5. Click the Access Control/Throttling tab. In the HTTP Flood Protection section, configure the following parameters.CC安全防护

      Parameter

      Description

      Status

      Enables or disables HTTP flood protection. This feature is enabled by default.

      Note

      When HTTP flood protection is enabled, all requests to your website are inspected by default. You can configure an Access Control/Throttling whitelist so that requests that meet the specified conditions bypass the inspection. For more information, see Configure a whitelist for access control/throttling.

      Mode

      Specifies the protection mode. Valid values:

      • Normal: Blocks only highly suspicious requests to minimize false positives. Use this mode when your website traffic is normal.

      • Emergency: Aggressively blocks HTTP flood attacks but may cause a higher number of false positives. Use this mode if the Prevention mode fails to block attacks and you observe slow website responses or unusual traffic, CPU, or memory usage.

        Note

        The Protection-emergency mode is suitable for web pages and H5 pages but not for APIs or native app services, because it may cause a high rate of false positives. For APIs and native apps, create a custom protection policy instead. For more information, see Create a custom protection policy.

    Related operations

    • If a significant number of attacks are still not blocked after you enable the Emergency mode, check whether attacks are bypassing WAF to target your origin server directly. If they are, configure your server to allow access only from WAF back-to-origin IP addresses. For more information, see Configure protection for an origin server.

    • For improved protection with a lower false positive rate, use a custom protection policy. For more information, see Create a custom protection policy.