Use case: Configure e-commerce security rules
This use case demonstrates how to configure security rules to protect an e-commerce platform from traffic attacks.
Threat scenario
During major shopping events like the Double 11 global shopping festival, high-traffic e-commerce platforms become prime targets for malicious attacks. For example, an e-commerce platform experienced a traffic attack where a single client IP address initiated high-frequency requests, with a request rate more than 20 times that of a normal user. These attacks consume excessive server resources, degrade the user experience, and can even cause system outages or disrupt normal business transactions.
Create a security rule
Analysis shows that the attack originated from a single client IP address with a request rate 20 times higher than normal. To mitigate this threat, you can create a security rule to block this IP address. Follow these steps:
On the ESA console, navigate to Websites. In the Website column, click the name of the target website.
In the left navigation pane, choose .
On the Security Rules page, click Create Rule. In the dialog box, enter a name in the Rule Name field and select Filtered Requests.
Under Filtered Requests, configure the match condition: select Client IP for the match field, select equals as the operator, and enter the IP address to block.
For more details on configuring rules, see Configure rules.
Verify the rule
Run the following command to test the rule. If the request is successfully blocked, the server returns an HTTP 403 status code.
curl -H "X-Forwarded-For: 192.168.0.1" https://www.example.comWhat to do next
To prevent similar attacks in the future, you can create a rate limiting rule. For example, if the average request rate for a normal user is 1,200 requests per minute, you can configure a rule to trigger a slider CAPTCHA challenge for any client that exceeds 1,300 requests per minute.
With a slider CAPTCHA, the Web Application Firewall (WAF) serves a verification page to the client. If the client successfully completes the challenge, the WAF allows all subsequent requests from that client for a specified period (default: 30 minutes) without requiring re-verification. Otherwise, the WAF blocks the request.
On the ESA console, navigate to Websites. In the Website column, click the name of the target website.
In the left navigation pane, choose .
On the Rate Limiting Rules tab, click Create Rule and configure the rule as shown in the following figure. For example, if the hostname is
www.example.comand the request rate from a single client IP exceeds 1,300 requests per minute, trigger a slider CAPTCHA for all subsequent requests from that IP address for one hour.