Glossary

Reading time: About 7 minutes

This page provides standardized definitions for all key terms used in this product documentation.

A

Advanced Detection
The third detection layer in Bot Management. It uses machine learning to analyze behavioral characteristics of requests (mouse trajectory simulation, request intervals, device fingerprinting, etc.) to identify advanced bots.

API Security
A security module specifically designed for API endpoints. It uses a positive security model (allowlist-based) to identify and block abnormal API access, such as undeclared endpoint access and parameter type violations.

Attack Request
A request that triggers a security policy with an action other than Log — meaning the platform has detected and performed a protective action such as Deny or verification on the request.

B

Blocked Request
The number of requests blocked by platform actions (Deny, Reset Connection, JS Verification, etc.).

Bot Management
A security module that identifies and handles automated bot traffic. It consists of four detection layers: Web Bot Detection, Workflow Detection, Advanced Detection, and Anomalous Traffic Detection.

C

Custom Rule
A security rule defined by the user based on specific business requirements. It supports combining multiple match conditions, and allows you to specify the action and priority.

D

DDoS Protection
A security module that defends against distributed denial-of-service attacks. It provides both application-layer (L7) and network-layer (L3/4) protection, supporting both managed rules and AI-driven protection mechanisms.

Deploy
The process of pushing configuration changes to all edge security nodes, making the new configuration effective across the global network. Deployment typically takes 2–3 minutes to complete.

E

Exception
A configuration that allows specific requests to skip the inspection of a specified policy module. Unlike a whitelist, an exception only excludes a specific policy (e.g., a particular WAF rule), while other policies continue to inspect the request normally.

Exclusive IP
A paid value-added service that assigns a dedicated scrubbing node IP to a hostname, enabling more granular network-layer DDoS protection and independent attack statistics.

M

Match Condition
Defines the scope of a security rule. Supports matching combinations of various field types, including request path, HTTP method, client IP, HTTP header, Cookie, and User-Agent.

O

Observation Mode
One of the operational modes for a policy. When enabled, the policy inspects requests and logs the results, but does not perform any blocking actions. It does not affect the normal response of any request. Used for validation before deploying a new policy.

R

Rate Limiting
Limits the maximum number of requests from the same source (IP, Cookie, etc.) within a given time period. Used to protect against brute-force attacks, API abuse, and other high-frequency attacks.

S

Scan Protection
A protection feature that specifically identifies and blocks reconnaissance activities such as security scanning tools and directory scraping tools. Supports two actions: Deny and Delay.

Security Policy
A complete set of protection configurations for a specific hostname, including five modules: DDoS Protection, WAF, Bot Management, API Security, and Threat Intelligence. Each hostname has its own independent security policy.

Shared Configuration
A configuration module that can be reused across multiple hostnames or security policies. When modified, the changes are automatically deployed to all hostnames that reference the configuration.

T

Threat Intelligence
A malicious IP database built from global security data, including categories such as IDC/cloud host IPs, anonymous proxies, and known scanners. Updated daily.

Traffic Abuse
An attack that consumes CDN bandwidth and traffic resources through a large volume of automated requests, typically aimed at causing financial loss (traffic costs). This differs from DDoS attacks, which aim to make services unavailable.

W

WAF (Web Application Firewall)
A security module that detects and blocks web application-layer attacks (SQL injection, XSS, command injection, etc.) based on a rule library.

Web Bot Detection
The first detection layer in Bot Management. It injects a JavaScript SDK into the client to determine whether the request originates from a real browser environment.

Whitelist
A set of conditions that allow requests to bypass all security policy checks. Suitable for fully trusted IPs or sources. Unlike an exception, a whitelist skips all security checks, while an exception only skips a specific policy.

Workflow Detection
The second detection layer in Bot Management. It analyzes the completeness of the user’s operational workflow (e.g., whether the steps of browsing → adding to cart → placing an order are followed) to identify automated bots that skip prerequisite steps.