Contents
Getting started
10-minute quick startArchitecture
Install and upgrade
Install the controllerAdd nodesOnline upgradesUninstall and migrate
Sites
Add a siteSet up the CNAME recordHTTPS certificatesCache rulesPurge and prefetchOrigin settings
Security
Security overview and big screenAttack logCC protectionWAFLists and access controlBots and scannersPaid protection add-ons
Analytics and alerts
StatisticsAccess logsAlerts and notifications
Accounts and licensing
Users and plansLicenses and add-ons

CC protection

About 6 minUpdated 2026-10-28

A CC attack drains a site's resources with large numbers of seemingly normal requests. CC protection is on by default.

Levels

Go to Security Center › Protection settings › CC protection. Requests not matched by a custom rule go through the selected CC rule set; the built-in levels range from "Off" to "Strict". The parameters of preset levels are read-only; choose "Custom" to change them.

  • The default level is enough for everyday sites.
  • Raise the level under attack; if you see "CC level too low", switch to "JS challenge" or higher as suggested.
  • A site can change its own level in its settings, and administrators can set the default level by scope (global / region / node).

Custom rules

Create custom rules for a site to target a certain path or condition. Requests that match a rule can be:

  • allowed;
  • banned;
  • given a human check: rate limit, silent check, 5-second shield, click check, slider and so on.
Tip API paths (login, SMS, search) suit a dedicated rate-limit rule; page paths suit the silent check, which barely bothers normal visitors.

IPs that skip protection

A list of IPs skips CC protection and challenges, one per line, with /8, /16 and /24 masks supported. Listed IPs are no longer affected by CC protection, so list only egress IPs you trust.

Caution If an allowlisted IP is abused by an attacker, protection is bypassed. Where lists and access control can narrow the scope, don't allow too widely.

View blocked requests in the attack log.