All Products
Search

This Product

    Web Application Firewall:Enable WAF protection for a custom domain name in Function Compute

    Document Center

    Web Application Firewall:Enable WAF protection for a custom domain name in Function Compute

    Last Updated:Jul 01, 2026

    To protect Function Compute (FC) functions bound to a custom domain name against web attacks, you can enable Web Application Firewall (WAF) protection for the functions. This solution provides low-latency and high-availability web security capabilities for your applications without changing the existing network architecture or DNS configurations.

    How it works

    image

    When you integrate a Function Compute custom domain name with a cloud product, the integration is implemented through SDK integration. The SDK is embedded in the cloud product and is responsible for traffic extraction, detection, and protection. WAF does not participate in traffic forwarding, which avoids compatibility and stability issues caused by additional forwarding layers.

    Scope

    If your Function Compute custom domain name does not meet the following requirements, use CNAME integration instead.

    • Account requirement: The FC custom domain name and the WAF instance must belong to the same Alibaba Cloud account (except for scenarios where centralized management across enterprise accounts is configured).

    • Region requirement: You can enable WAF protection only for FC custom domain names in the China (Hangzhou), China (Shanghai), China (Beijing), China (Zhangjiakou), and China (Shenzhen) regions.

    Procedure

    1. Go to the console:

      Log on to the Web Application Firewall 3.0 console. In the top navigation bar, select the resource group and region of the WAF instance (Chinese Mainland).In the left-side navigation pane, click Onboarding. Click the Cloud Native tab. In the cloud product type list on the left, select Function Compute.

    2. Cloud product authorization (for users who have not completed authorization):

      Follow the prompts on the page and click Authorize Now to complete the cloud product authorization. You can go to the Identities > Roles page in the RAM console to view the created service-linked role AliyunServiceRoleForWAF.

    3. Integrate the FC custom domain name:

      1. Click Add. You are navigated to Function Compute console.

      2. In the top navigation bar, select the region China (Hangzhou), China (Shanghai), China (Beijing), China (Zhangjiakou), and China (Shenzhen). In the left-side navigation pane, choose Function Management > Custom Domains. Find the created custom domain name and click Modify in the Actions column.

      3. On the Modify Custom Domain Name page, set Web Application Firewall (WAF) to Enable, and then click Save.

        Note

        If you have not created a custom domain name in Function Compute, see Custom domain configuration.

    4. Verify the protection effect:

      Return to the Custom Domains page. When the Web Application Firewall (WAF) column for the target custom domain name displays Enabled, the integration is successful. At this point, enter your custom domain name and a web attack code in the browser for verification (for example, <your domain name>/alert(xss), where alert(xss) is a cross-site scripting attack code used for testing). If a 405 interception page is returned, the attack has been successfully intercepted and WAF protection has taken effect.

    What to do next

    View and configure protection rules

    After the integration is complete, WAF automatically creates a protection object with the -fc suffix and enables protection rules for the protection object by default, including rules in the core web protection module. You can view the protection object on the Protection Config > Protected Objects page in the WAF console. If the default protection rules do not meet your business requirements, you can create or edit protection rules. For more information, see Protection configuration overview.

    Integration rollback

    • Temporarily disable WAF protection: If issues occur after the integration, such as a large number of false positives, and you need to temporarily disable WAF protection, you can go to the Protected Objects page in the WAF console and turn off the WAF Protection Status switch. For more information, see Disable WAF protection.

    • Remove integration: If you no longer want to use WAF to protect your FC custom domain name, you can go to Function Compute console, choose Function Management > Custom Domains, find the created custom domain name, click Modify in the Actions column. On the Modify Custom Domain Name page, set Web Application Firewall (WAF) to Disable, and then click Save.

      Important

      • After the integration is removed, your business traffic is no longer protected by WAF, and the security reports no longer include protection data for the related traffic.

      • If your WAF instance is billed on a pay-as-you-go basis, no request processing fees are incurred after the integration is removed. However, function fees are still incurred due to the WAF instance itself and other protection rules. If you no longer want to use WAF and want to stop WAF billing, see Terminate the WAF service.

    Quotas and limits

    • Number of integrated instances: The number does not exceed the upper limit of the WAF instance specification.

      • Subscription WAF instance: a maximum of 300 for the Basic edition, 600 for the Advanced edition, 2,500 for the Enterprise edition, and 10,000 for the Ultimate edition.

      • Pay-as-you-go WAF instance: a maximum of 10,000.

    • Unsupported features: The protection objects integrated through Function Compute do not support the following features: website tamper-proofing, sensitive data protection, bot management, and API security.

    FAQ

    Why is the Enable switch for Web Application Firewall (WAF) not available?

    This indicates that the FC custom domain name does not meet the Scope. Currently, only custom domain names in specific mainland China regions support integration through the cloud product integration method. To use this integration method, you must purchase a mainland China WAF instance for integration, or use CNAME integration instead.

    What is the difference between cloud product integration and CNAME integration in WAF? Can they be used together?

    WAF supports two integration methods: cloud product integration and CNAME integration.

    • Cloud product integration (the method described in this topic): Quickly integrates Alibaba Cloud product instances within your account.

    • CNAME integration: Integrates domain names. This method applies to a wide range of scenarios and supports cross-account and cross-cloud scenarios.

    The two methods cannot be used at the same time. Each domain name can use only one integration method. Duplicate configurations cause traffic forwarding conflicts and result in protection failure. For more information about the differences, see the Overview topic.