Overview

フォーカスモード

フォントサイズ

最終更新日: 2026-04-23 16:06:19

Security protection provides security policy configuration and security event alarm options for applications connected to EdgeOne, helping you verify traffic and requests at the edge to prevent external attacks and security risks from impacting your business and sensitive data.
After accessing the EdgeOne SCDN service and subscribing to related security protection services, you can configure the following security policies:
Note:
DDoS protection-related configurations are only available for L4 proxy instances with DDoS Protection that users can configure.
If you need to configure Referer allowlist and blocklist, UA allowlist and blocklist, IP address allowlist and blocklist, or region blocking through Web Protection, please use Web Protection > Custom Rules > Basic Access Control. For details, refer to Web Protection - Custom Rules.
Configurable rules and execution options may vary depending on the EdgeOne plan you subscribe to. For plan specifications, see Plan Comparison.
Category
Feature
Use Cases
Default Configuration
Anti-DDoS
(Network layer Anti-DDoS)
Anti-DDoS Protection Level
Automatic mitigation protects against DDoS attacks on Layer 4 services (TCP/UDP applications).
For example:
Routine protection: Use a balanced protection level to discard traffic exhibiting obvious DDoS attack characteristics.
Attack passthrough emergency recovery: Use the strict protection level to discard all traffic suspected of DDoS attacks.
Protection Level: Balanced
﻿
IP Allowlist and Blocklist
Discard or allow traffic from specified IPs.
For example:
Allow internal calls: Allow internal service IP address 11.11.11.11 to permit frequent access between services.
None.
﻿
Region Blocking
Blocks client access from specified regions.
For example:
Block traffic from outside the Chinese mainland: Discard traffic with source IPs from regions outside the Chinese mainland.
None.
﻿
Port Filtering
Discard or allow traffic from a specified source port/destination port.
For example:
Discard high-risk reflection ports: Discard traffic with source ports matching UDP 53 to prevent access to private UDP protocol applications.
None.
﻿
Feature Filtering
Discard traffic containing specified data or parameters.
For example:
Discard abnormally long UDP packets: Discard UDP traffic with length exceeding 500.
None.
﻿
Protocol Blocking
Discard traffic with specified IP protocols.
For example:
Block external PING commands: Configure to block ICMP protocol traffic.
None.
﻿
Connection Attack Protection
Block abnormal TCP behaviors such as high-frequency connection attempts and abnormal connections.
None.
Web Protection
Platform-managed rate limiting rules (formerly CC attack protection)
Mitigate HTTP/HTTPS DDoS attacks, including high-frequency access attacks and slow-rate attacks.
Adaptive Frequency Control
Restriction Level: Adaptive - Lenient
Action: JavaScript Challenge
Slow-rate Attack Protection
Not enabled
Intelligent Client Filtering
Action: JavaScript Challenge
﻿
Managed Rules
Blocking exploit attacks against Web applications (SQL injection, cross-site scripting, remote command execution, and so on).
For example:
Block Apache log4j vulnerability: Enable log4j-related rules in open-source component vulnerabilities for blocking.
Enable all rules to Observation Mode
﻿
Custom Rules
Take action on requests based on headers and IP address.
For example:
Hotlink Protection: Block requests by matching Referer headers.
Region Blocking: Block requests by matching the client IP address region.
IP blocklist: Block by specified IP address or IP address groups.
None.
﻿
Custom Rate Limiting Rules
Block clients that exceed the preset access rate.
For example:
Block clients that cause a large number of errors on the origin server in a short time: Set the allowed rate of origin errors per IP address, and block access to the origin when the threshold is exceeded.
Block account IDs that access specific APIs with excessive frequency: Set the allowed access frequency per account (specifying the parameter location of the account ID) for designated APIs, and block account access when the threshold is exceeded.
Block clients with excessive client fingerprint (JA3 fingerprint) access frequency: Set the access rate limit per JA3 fingerprint (that is, TLS fingerprint). Requests exceeding the threshold from identical fingerprints will be blocked.
None.
﻿
Protection Exception Rules - Bypassing Protection Modules
Skipping protection rules in Web protection by module.
For example:
Allow internal services: Set an internal service IP list and specify the API path to permit clients on the list unrestricted access to the path.
None.
﻿
Protection Exception Rules - Bypassing Specified Managed Rules
Bypass specified managed rules.
For example:
Allow user-generated content uploads: When requests contain parameters with user-authored content, configure the business path and false positive rules to allow the requests.
None.
Bot Management
Bot Intelligent Analysis
Intercept Bot requests by risk level. (Suitable for rapidly enabling Bot management policies and establishing Bot access profiles.)
For example:
Block CDN resource abuse (hotlinking): Block malicious Bot requests.
None.
﻿
Bot Basic Management
Handle crawlers for search engines, open-source development tools, and commercial purposes.
For example:
Allow Google search engine crawlers to access: Use the signature-based ruleset for search engines to configure Google crawlers to be allowed.
Block cURL tool access: Use the UA signature library to block Web development tools access.
None.
﻿
Client-side Profile Analytics
Handle client requests with a history of malicious behavior or high-risk characteristics based on IP address threat intelligence.
For example:
Block VPN / proxy requests: Block client requests identified as malicious proxies, fast-flux IP addresses, or proxy IP address pools.
None.
﻿
Proactive Feature Recognition
Block requests with abnormal browser runtime environment and access behavior.
For example:
Cookie Challenge: Enable cookie validation to block clients that do not support cookies.
Block automated tool access: Enable client behavior validation to identify automated tools with abnormal JavaScript runtime environments and access behavior.
None.
﻿
Custom Bot Rules
Based on the Bot access characteristics, headers, and client IP address of requests, combat Bot tools. This feature provides more mitigation options for Bot defense.
For example:
Mitigate malicious bots accessing sensitive services: Match based on access paths and client profiling, and configure observation, silent blocking, and delayed response with specific weights.
None.
﻿
﻿
﻿

ヘルプとサポート

この記事はお役に立ちましたか？

営業担当者にお問い合わせいただくかチケットを提出してサポートを求めることができます。

フィードバック

tencent cloud

Tencent Cloud EdgeOne

Overview

ヘルプとサポート

Category	Feature	Use Cases	Default Configuration
Anti-DDoS (Network layer Anti-DDoS)	Anti-DDoS Protection Level	Automatic mitigation protects against DDoS attacks on Layer 4 services (TCP/UDP applications). For example: Routine protection: Use a `balanced` protection level to discard traffic exhibiting obvious DDoS attack characteristics. Attack passthrough emergency recovery: Use the `strict` protection level to discard all traffic suspected of DDoS attacks.	Protection Level: Balanced
		IP Allowlist and Blocklist	Discard or allow traffic from specified IPs. For example: Allow internal calls: Allow internal service IP address `11.11.11.11` to permit frequent access between services.	None.
		Region Blocking	Blocks client access from specified regions. For example: Block traffic from outside the Chinese mainland: Discard traffic with source IPs from regions outside the Chinese mainland.	None.
		Port Filtering	Discard or allow traffic from a specified source port/destination port. For example: Discard high-risk reflection ports: Discard `traffic with source ports matching UDP 53` to prevent access to private UDP protocol applications.	None.
		Feature Filtering	Discard traffic containing specified data or parameters. For example: Discard abnormally long UDP packets: Discard UDP traffic with length exceeding 500.	None.
		Protocol Blocking	Discard traffic with specified IP protocols. For example: Block external PING commands: Configure to block ICMP protocol traffic.	None.
		Connection Attack Protection	Block abnormal TCP behaviors such as high-frequency connection attempts and abnormal connections.	None.
Web Protection	Platform-managed rate limiting rules (formerly CC attack protection)	Mitigate HTTP/HTTPS DDoS attacks, including high-frequency access attacks and slow-rate attacks.	Adaptive Frequency Control Restriction Level: Adaptive - Lenient Action: JavaScript Challenge Slow-rate Attack Protection Not enabled Intelligent Client Filtering Action: JavaScript Challenge
		Managed Rules	Blocking exploit attacks against Web applications (SQL injection, cross-site scripting, remote command execution, and so on). For example: Block Apache log4j vulnerability: Enable log4j-related rules in open-source component vulnerabilities for blocking.	Enable all rules to Observation Mode
		Custom Rules	Take action on requests based on headers and IP address. For example: Hotlink Protection: Block requests by matching Referer headers. Region Blocking: Block requests by matching the client IP address region. IP blocklist: Block by specified IP address or IP address groups.	None.
		Custom Rate Limiting Rules	Block clients that exceed the preset access rate. For example: Block clients that cause a large number of errors on the origin server in a short time: Set the allowed rate of origin errors per IP address, and block access to the origin when the threshold is exceeded. Block account IDs that access specific APIs with excessive frequency: Set the allowed access frequency per account (specifying the parameter location of the account ID) for designated APIs, and block account access when the threshold is exceeded. Block clients with excessive client fingerprint (JA3 fingerprint) access frequency: Set the access rate limit per JA3 fingerprint (that is, TLS fingerprint). Requests exceeding the threshold from identical fingerprints will be blocked.	None.
		Protection Exception Rules - Bypassing Protection Modules	Skipping protection rules in Web protection by module. For example: Allow internal services: Set an internal service IP list and specify the API path to permit clients on the list unrestricted access to the path.	None.
		Protection Exception Rules - Bypassing Specified Managed Rules	Bypass specified managed rules. For example: Allow user-generated content uploads: When requests contain parameters with user-authored content, configure the business path and false positive rules to allow the requests.	None.
Bot Management	Bot Intelligent Analysis	Intercept Bot requests by risk level. (Suitable for rapidly enabling Bot management policies and establishing Bot access profiles.) For example: Block CDN resource abuse (hotlinking): Block malicious Bot requests.	None.
		Bot Basic Management	Handle crawlers for search engines, open-source development tools, and commercial purposes. For example: Allow Google search engine crawlers to access: Use the signature-based ruleset for search engines to configure Google crawlers to be allowed. Block cURL tool access: Use the UA signature library to block Web development tools access.	None.
		Client-side Profile Analytics	Handle client requests with a history of malicious behavior or high-risk characteristics based on IP address threat intelligence. For example: Block VPN / proxy requests: Block client requests identified as malicious proxies, fast-flux IP addresses, or proxy IP address pools.	None.
		Proactive Feature Recognition	Block requests with abnormal browser runtime environment and access behavior. For example: Cookie Challenge: Enable cookie validation to block clients that do not support cookies. Block automated tool access: Enable client behavior validation to identify automated tools with abnormal JavaScript runtime environments and access behavior.	None.
		Custom Bot Rules	Based on the Bot access characteristics, headers, and client IP address of requests, combat Bot tools. This feature provides more mitigation options for Bot defense. For example: Mitigate malicious bots accessing sensitive services: Match based on access paths and client profiling, and configure observation, silent blocking, and delayed response with specific weights.	None.