---
schema_version: "1"
id: e4d989b5528cbf850ba1093e3cf6b966e1dd52eedf31d4625990eb4e4286dbdb
title: Configure WAF Settings for an eCDN Zone
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_configure_zone_waf_settings.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_configure_zone_waf_settings.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 0b2d4ba6771d87d4c1739c91e1eb9f3503c229af15706827be6d5b6d9dd7f310
description: Configure web application firewall (WAF) managed rulesets for an eCDN zone for B2C Commerce by using the Security Rules tab in Configure Zones in Business Manager.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Configure WAF Settings for an eCDN Zone

Configure web application firewall (WAF) managed rulesets for an eCDN zone for B2C Commerce by using the Security Rules tab in Configure Zones in Business Manager.

The Security Rules tab includes a **WAF Rules** section at the bottom of **Zone Security Rules**. Use this section to enable rulesets and configure how matched requests are handled. For information about what each ruleset does, see [eCDN WAF Managed Rulesets](https://help.salesforce.com/s/articleView?id=cc.b2c_waf_managed_rulesets.htm&release=264.0.0&type=5 "The embedded CDN (eCDN) web application firewall (WAF) protects your B2C Commerce storefront through two managed rulesets: the eCDN WAFv2 Managed Ruleset and the OWASP WAFv2 Managed Ruleset. You enable and tune each ruleset per zone.").

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png)

Note eCDN WAF managed rules aren't available on SCAPI zones. See [SCAPI Zone Support for B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_scapi_zone.htm&release=264.0.0&type=5 "A SCAPI zone is the Salesforce-managed eCDN zone that fronts Salesforce Commerce API (SCAPI) traffic. Starting with B2C Commerce 26.10, the Production instance includes a subset of eCDN security controls and analytics for this zone in Business Manager and the CDN API, with no support case required.").

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_important.png)

Important Exposed Credentials Check is deprecated and was removed from Embedded CDN Settings in B2C Commerce 26.10. Leaked Credentials Detection is a separate capability, and Exposed Credentials Check doesn't work with Leaked Credentials Detection. To act on leaked credentials, create a custom firewall rule or a rate-limiting rule that uses the Leaked Credentials Detection fields. See [Create a Custom Firewall Rule for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_create_eCDN_firewall_rule.htm&release=264.0.0&type=5 "Configure a custom firewall rule to control incoming traffic to your B2C Commerce storefront based on specified request parameters.") and [Create a Rate Limiting Rule for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_eCDN_create_rate_limiting_rule.htm&release=264.0.0&type=5 "Configure a rate limiting rule to specify rate limits for requests that match a particular expression and then perform an action when requests reach those rate limits. Rate limiting rules improve B2C Commerce storefront availability, target specific traffic patterns and combat threats, such as bots.").

![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_tip.png)

Tip When you turn on WAF for the first time on a zone, set the ruleset **Action** to **Log** for at least a week before you switch to an enforcing action. Log mode records matches without blocking or challenging traffic, so you can review the WAF logs and make data-backed decisions about the action and thresholds for your storefront. See [eCDN WAF Logs](https://help.salesforce.com/s/articleView?id=cc.b2c_waf_net_traffic_logs.htm&release=264.0.0&type=5 "eCDN logs include information about all of your B2C Commerce network traffic, not just the traffic that the web application firewall (WAF) acts on. Use the logs to track IP-reputation–blocked traffic and to see how much of your traffic doesn't trigger WAF.").

1. In Business Manager, click the App Launcher, and then select **Administration** | **Sites** | **Embedded CDN Settings**.
2. Locate the zone you want to configure and select **Configure Zone** from the dropdown menu.
3. Select the **Security Rules** tab, then select the **Zone Security Rules** sub-tab.
    
    **Zone Security Rules — Custom Firewall Rules and Rate Limiting**
    
    ![Configure Zones Security Rules tab showing Custom Firewall Rules and an empty Rate Limiting Rules list, and the top of WAF Rules.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_configure_zone_security_rules.png)
4. Expand the **WAF Rules** section.
5. Configure the **WAFv2 eCDN Managed Ruleset**.
    
    This eCDN-curated ruleset provides high-confidence, high-impact protections and is updated frequently to cover new vulnerabilities.
    
     
    | Field | Description |
    | --- | --- |
    | Enabled | Turn the ruleset on or off. |
    | Action | What to do on a match: Default, Block, Log, Managed Challenge, JS Challenge, or Legacy Captcha. |
6. Configure the **WAFv2 OWASP Managed Ruleset**.
    
    This ruleset uses the OWASP ModSecurity Core Rule Set and is aligned with the latest upstream version.
    
     
    | Field | Description |
    | --- | --- |
    | Enabled | Turn the ruleset on or off. |
    | Action | What to do when the threat-score threshold is exceeded: Block, Log, Managed Challenge, JS Challenge, or Legacy Captcha. |
    | Anomaly Score Threshold | Low (60 and higher), Medium (40 and higher), or High (25 and higher). Lower thresholds catch more requests but can increase false positives. |
    | Paranoia Level | PL1 (default), PL2, PL3, or PL4. Higher levels add stricter rules and can increase false positives. |

**WAF Rules on a B2C Commerce 26.10 instance**

![WAF Rules on a B2C Commerce 26.10 instance showing the WAFv2 eCDN Managed Ruleset set to Default and the WAFv2 OWASP Managed Ruleset set to Block, with Anomaly Score Threshold Medium, 40 and higher, and Paranoia Level PL1](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_waf_rules.png)

After you enable a ruleset in **Log** mode, review the WAF logs before you switch to an enforcing action. When reviewing your logs, consider the following:

- Which rules are triggering, and how often?
- Which countries are triggering rules? Do you sell or ship product to those countries?
- What IP addresses are associated with triggered rules or suspected bad actors? An IP lookup on a troublesome address can identify where it's registered.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d241915e334">IP Address Registered Source</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d241915e337">Reason for Access</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="IP Address Registered Source" class="slds-cell-wrap" style="vertical-align:top;" headers="d241915e334 ">Google</td>

            <td data-label="Reason for Access" class="slds-cell-wrap" style="vertical-align:top;" headers="d241915e337 ">Search engines (typically good bots).</td>

          </tr>
          <tr class="">
            <td data-label="IP Address Registered Source" class="slds-cell-wrap" rowspan="2" style="vertical-align:top;" headers="d241915e334 ">Amazon Web Services (AWS)</td>

            <td data-label="Reason for Access" class="slds-cell-wrap" style="vertical-align:top;" headers="d241915e337 ">Good scrubbing (information used across the Internet and intended to drive more
              sales).</td>

          </tr>
          <tr class="">
            <td data-label="Reason for Access" class="slds-cell-wrap" style="vertical-align:top;" headers="d241915e337 ">Bad scrubbing (inventory scraping bots that target sites to identify valuable content
              like text, images, or prices).</td>

          </tr>
          <tr class="">
            <td data-label="IP Address Registered Source" class="slds-cell-wrap" style="vertical-align:top;" headers="d241915e334 ">Competitor</td>

            <td data-label="Reason for Access" class="slds-cell-wrap" style="vertical-align:top;" headers="d241915e337 ">Competitors scanning your site to gather intelligence.</td>

          </tr>
        </tbody>
      </table>

If the logs identify many bad actors, tighten protection. For example, raise the OWASP ruleset's Anomaly Score Threshold or paranoia level, or switch the ruleset action to Managed Challenge or Block. If WAF is matching real shopper activity, loosen those settings. For details on the fields in each log, see [eCDN WAF Log Fields and JSON Output](https://help.salesforce.com/s/articleView?id=cc.b2c_waf_log_fields_json_output.htm&release=264.0.0&type=5 "Request B2C Commerce eCDN-WAF log files through the Open Commerce API (OCAPI). This reference covers the request constraints, an example call, the JSON log output, and the fields each log returns.").