Set DDoS Policies
최신 업데이트：2026-03-25 10:09:22
Reading time: About 6 minutes
Prerequisites: A hostname has been onboarded and DDoS security policy has been enabled
After you enable DDoS Protection, the platform automatically detects and mitigates DDoS attacks against your website. You can adjust and fine-tune your DDoS protection policy as needed.
Path: Security Settings > Policies > [target hostname] > DDoS Protection (top navigation tab)
Configure L3/4 DDoS Protection
To protect the availability of the platform’s infrastructure and all customers, network-layer protection is enabled by default and cannot be disabled.
Configure L7 DDoS Protection
Select a Protection Level
After enabling L7 DDoS protection, select an appropriate security protection level based on your business scenario. Each protection level affects the attack-detection sensitivity and the threshold for generating AI rules. See the table below:
| Level | Protection Effect | Recommended For | Attack Detection Sensitivity | AI Rule Generation Threshold |
|---|---|---|---|---|
| Loose | Blocks known, specific malicious attacks by default. The AI engine only activates adaptive protection when it detects a significant drop in website availability, resulting in an extremely low false-positive rate. | Websites with high request volumes and strong processing capacity, or special event scenarios. | Low (requires detecting a significant drop in availability) | Medium |
| Moderate (Recommended) | Effectively protects against common malicious attacks; suitable for the vast majority of business scenarios. | Websites with stable request volumes and normal processing capacity. | Medium | Medium |
| Strict | Enables strict protection, which may cause some false positives. | Scenarios with low request volumes, weak processing capacity, or strict scrubbing requirements. | High | High |
We recommend adjusting the protection level promptly based on your scenario — temporarily switch to Strict during an attack, or to Loose during an event, to minimize the impact on legitimate users.
Configure Managed Rules
We recommend keeping Managed Rule Protection enabled by default, with the Action and Rule Mode settings left at their defaults.
Adjust the Action or Rule Mode
- Action: When a request matches a managed rule, the system automatically takes the corresponding protection action:
| Handling Action | Description |
|---|---|
| Deny | Denies the request and returns an HTTP 403 response |
| Log | Only logs the request; takes no action on it |
| DDoS Managed Challenge | Dynamically select Cookie challenge or JavaScript challenge for request validation |
| Deny Connection | Releases established TCP connections and rejects new connection attempts |
- Rule Mode: Defines when the rule takes effect. The intelligent protection engine can adaptively switch modes, as follows:
| Rule Mode | Description |
|---|---|
| Default On | The rule always takes effect, regardless of whether an attack is detected |
| Enable During Attack | The rule takes effect only when an attack is detected |
| Essentially Off | The rule takes effect only as an additional measure when the edge node’s infrastructure performance is affected |
| Not Used | The rule never takes effect, regardless of whether an attack is detected |
Add an App/API Exception
Among the managed rules, when the handling action is set to DDoS Managed Challenge, it may not be suitable for APP/API traffic and can cause false positives. We recommend configuring an exception based on the request characteristics of your APP/API traffic. For configuration steps, see Configuring App/API Exceptions.
Configure AI-Powered Protection
After AI-Powered Protection is enabled, the system automatically deploys recommended protection rules based on the selected protection level and detected attack characteristics. We recommend keeping this feature enabled by default, with the mode set to Protection, for the best security results.
Adjust the Protection Mode
If you want to observe traffic characteristics in advance or reduce the risk of false positives during an attack, you can adjust the AI protection mode based on your business needs. The mode you select determines the handling action applied by the rules the engine pushes. See the table below for the mapping and description of each mode:
| Mode | Corresponding Handling Action | Description |
|---|---|---|
| Protection (Default) | Deny | AI protection rules directly deny requests that match the rule |
| Protection (Managed) | DDoS Managed Challenge | Adaptively triggers Cookie or JavaScript Challenges based on the web client’s characteristics, reducing the false-positive rate |
| Monitor | Log | Only requests that hit the rule are logged in the attack log, where detailed attack information will be recorded |
View AI Protection Rules
The DDoS adaptive protection engine automatically generates or removes protection rules based on the severity of the attack threat, with no manual intervention required. To view the automatically generated AI protection rules, use the following methods:
Rule Naming
You can quickly identify the attack type in an operational context by reviewing the AI protection rule’s name. Rules are named using the format AI_<rule category>_xxxxx. For example, AI_High-Frequency Directory Request Limiting_xxxxx indicates that the currently active rule is a rate-limiting rule.
View Requests That Matched an AI Protection Rule
If an attack is currently in progress and AI-Powered Protection has been triggered, you can view the currently generated protection rules directly in the AI-Powered Protection list.
If you want to analyze the log data for requests that matched an AI protection rule — to verify that the rule accurately matches your business traffic characteristics and that only genuine attack traffic is being blocked:
- Go to Analysis & Logs > Attack Logs
- Use the filter to set
DDoS Protection - Policy Nameequal toAI-Powered Protection - Click a filtered attack log entry to view the specific request information, rule information, and client information
Review the AI Protection Rule Deployment History
AI protection rules are generated only during an attack and are automatically removed 20 minutes after the attack ends. To view historical deployment records:
- Go to the Change History page
- Filter by configuration Security Policy - DDoS Protection and change type Added
- Locate the entry where the Operator is
system, then click the change details to view the AI rules that were deployed during the attack
If a specific AI rule proves effective against multiple attacks, we recommend manually configuring it as a Custom Rule or in Rate Limiting for continuous protection.