DocsICP FilingConsole
Documentation
Home Page Edge Security Acceleration ESA (Next-Gen) User Guide Security overview WAF Rule details Custom rules

Custom rules

Updated at:
Copy as MD
Product
My Favorites

If your website requires custom access control policies, you can create custom rules. A custom rule allows you to define match conditions for incoming requests and specify an action, such as block or monitor, for matching requests. This gives you flexible control over the content users can access.

Important

Accuracy of client IP geolocation

When using WAF custom rules with the rules engine to block requests, note that IP geolocation data (such as continent, country/region, province, and ISP) may not be 100% accurate. Misidentification can occur, so use this feature with caution.

If you encounter inaccuracies in client IP geolocation, you can create a whitelist rule to allow specific IP addresses. This prevents WAF from incorrectly blocking legitimate client IP addresses.

Configure a custom rule

  1. In the ESA console, select Websites, and in the Website column, click the target site.

  2. In the left navigation pane, choose Security > WAF.

  3. Click the Custom Rules tab, and on the Custom Rules tab, click Create Rule.

    • Enter a Rule Name.

    • In the If requests match... area, configure the match conditions. For more information, see Rule expression syntax.

    • In the Then execute... area, specify an action for matching requests. For more information, see Actions.

  4. Click OK.

Actions

  • Block: Blocks matching requests and returns a block page to the client.

    Note

    Customize block pages through Configure custom pages.

  • Monitor: Allows matching requests to pass but logs the event. Use monitor mode to test new rules and check WAF logs for false positives. After confirming no false positives, change the action to Block.

    Note

    You must enable Log Service to use the log query feature.

  • JavaScript Challenge: ESA returns a JavaScript snippet to the client. If the browser executes the script successfully,ESA allows all subsequent requests from that client for a default period of 30 minutes without another challenge. Otherwise, the request is blocked.

  • Slider CAPTCHA: ESA returns a slider CAPTCHA page. If the client solves the CAPTCHA, ESA allows all subsequent requests from that client for a default period of 30 minutes. Otherwise, the request is blocked.

    Note

    • Requests that pass the Slider CAPTCHA are billed; blocked requests are not.

    • JavaScript Challenge and Slider CAPTCHA for WAF custom rules and rate limiting rules apply only to static pages. For asynchronous APIs (XMLHttpRequest and Fetch), enable these challenges in Bots. When a matching request passes the challenge, ESA adds a Cookie acw_sc__v2 or acw_sc__v3 to the HTTP header to mark the client as verified.

  • Strict Slider CAPTCHA: In strict CAPTCHA mode, each client request must pass verification (unlike the Slider CAPTCHA which allows a 30-minute pass-through for previously verified clients). Enable with caution. Strict Slider CAPTCHA is available only for Enterprise plans upon request.

For more CAPTCHA types, such as one-click verification, use the AI Captcha feature. It supports various challenge types, including one-click, slider, and rotation puzzles, and can be configured separately in the ESA console.

Configuration example

Scenario: In Security Analytics or Event Analysis, you find that the client IP 192.168.0.1 is sending suspicious requests to the hostname dns.example.com.

Configuration:

Parameter

Example value

If requests match...

Both of the following conditions are met:

  • Hostname equals dns.example.com

  • Client IP equals 192.168.0.1

You can also use the following expression directly: (http.host eq "dns.example.com" and ip.src eq 192.168.0.1)

Then execute...

Block the request and respond with the Default Error Page

Result: The custom rule blocks all matching requests.

Feature availability by plan

Feature

Free

Basic

Standard

Advanced

Enterprise

Number of custom rules

5

10

50

100

100

Note

The Free plan does not support match conditions based on fields such as Ip.Geoip.Country. If you use this field in a custom rule, the system returns an Ip.Geoip.Country.NotSupport error. To use geolocation-based match conditions, you must upgrade to higher plan.

FAQ

Related documentation

Rule-related features vary in effective priority, reentrancy, and effective granularity. For details, see Characteristics of rule-based features.

Previous：Rule detailsNext：Rate limiting rules