Security overview

Feature

Description

Security analytics

Security analytics shows WAF and bot management data, including blocked, observed, and other request metrics. Use this data to fine-tune your protection rules.

Event analysis

Event analysis aggregates and analyzes security event data, helping you identify threats, assess risks, and respond accordingly.

Intelligent protection

Intelligent rate limiting

Smart Rate Limiting enhances Rate Limiting Rules with the ESA AI engine. Instead of manually analyzing traffic and defining rules, you select a protection level. The system trains a baseline from your site's past seven days of traffic and updates it daily.

One-click abuse prevention

The ESA abuse prevention feature combines global monitoring of anomalous traffic with an open-source IP reputation database updated daily. This feature effectively mitigates traffic abuse from sources like Peer-to-Peer CDN (PCDN) platforms and automated scripts, helping you avoid substantial financial losses.

WAF

Custom rules

If your website requires custom access control policies, you can create custom rules. A custom rule allows you to define match conditions for incoming requests and specify an action, such as block or monitor, for matching requests. This gives you flexible control over the content users can access.

Rate limiting rules

Rate limiting in Edge Security Acceleration (ESA) lets you control requests that match specific features. For example, if a client IP accesses your site at a high frequency, you can use this feature to apply a slider challenge or block the IP for a specified period after a threshold is exceeded.

Managed rules

Managed rules are intelligent built-in ESA protection rules that defend against OWASP attacks and the latest origin server vulnerabilities, including SQL injection, XSS, code execution, CRLF, remote file inclusion, and WebShell. Enable protection without manual rule configuration or updates.

Scanning protection rules

Scan protection identifies scanner behavior and signatures to block large-scale scans against your website, then blocks or blacklists the attack source to reduce intrusion risk and unwanted traffic.

Whitelist rules

Whitelist rules let specific requests bypass all or selected WAF protection modules, preventing false positives from internal services or known partners.

IP access rules

IP access rules let you allow, challenge, or block traffic by source IP, ASN, or geographic location. HTTP (Layer 7) IP access rules are available to all plans. TCP/UDP (Layer 4) IP access rules require an Enterprise plan.

Bot management

ESA provides two modes, Smart Mode and Professional Mode, for different protection needs.

DDoS

ESA monitors traffic in real time to identify attack patterns like SYN floods, ACK floods, and CC attacks. When it detects unusual traffic, ESA promptly blocks malicious requests while allowing legitimate traffic to pass, ensuring business continuity.

API security

Rapid business iterations often introduce core pain points such as unclear API assets, unknown attack surfaces, and decentralized security policy management. The API Security feature of Edge Security Acceleration (ESA) is designed to address these issues. It helps you build a unified API security barrier at the edge layer. This feature provides automatic discovery, continuous monitoring, and security protection for your business APIs by analyzing access requests that flow through points of presence (POPs) and using machine learning models.

Origin protection

Add the list of ESA node IP addresses to the firewall rules of your origin server. This protects your origin server by allowing only requests or traffic from the IP addresses in the allowlist to access it.

Other security settings

On the security settings page, you can define how ESA identifies client IP addresses, adjust the global security level for threat challenges, and configure the request body detection limit for security rule matching.