--- schema_version: "1" id: 68b5e38d12d93d2146ca3233e197adc59b6d2891bc964eade52991b2138cdba0 title: Create a Custom Firewall Rule for an eCDN Zone collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_create_eCDN_firewall_rule.md canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_create_eCDN_firewall_rule.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 2f0c61e9e84ddb65ff615d0173fefcc1f2b04c9439e05fa2668cff047f57991d description: Configure a custom firewall rule to control incoming traffic to your B2C Commerce storefront based on specified request parameters. products: - Commerce - B2C Commerce release: "264" --- # Create a Custom Firewall Rule for an eCDN Zone Configure a custom firewall rule to control incoming traffic to your B2C Commerce storefront based on specified request parameters. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png) Note Custom firewall rules are available on SCAPI zones. There's one SCAPI zone for Development, Staging, and Production. Configure it only from the Production instance. It doesn't appear in Business Manager or the CDN API on Development or Staging. Scope every rule by the org ID in the URL path so that it doesn't affect other environments. Some rules on SCAPI zones are Salesforce-managed and locked. See [SCAPI Zone Support for B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_scapi_zone.htm&release=264.0.0&type=5 "A SCAPI zone is the Salesforce-managed eCDN zone that fronts Salesforce Commerce API (SCAPI) traffic. Starting with B2C Commerce 26.10, the Production instance includes a subset of eCDN security controls and analytics for this zone in Business Manager and the CDN API, with no support case required."). 1. In Business Manager, click App Launcher ![App Launcher](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/appLauncher.png), and then select **Administration** | **Sites** | **Embedded CDN Settings**. 2. Locate the zone you want to configure, and select **Configure Zone** from the dropdown menu. ![Embedded CDN Settings zone list with Configure Zone selected from the zone actions menu](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_configure_zone_select_zone.png) 3. From the Security Rules tab, click **New Custom Rule**. Also, to switch to a different zone from this tab, select another name from the **Zone** dropdown. ![Security Rules tab showing Custom Firewall Rules with New Custom Rule and Rate Limiting Rules with New Rate Limiting Rule](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_security_rules_list.png) 4. Enter a **Rule Name**. For example, "Block requests from user\_agent\_x." ![New Custom Firewall Rule form with Rule Name, Enable Rule Upon Saving, Field, Operator, Value, Choose action, Placement, Select order, and Save](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_new_custom_firewall_rule.png) 5. (Optional) If you want the rule to be active when you save it, select **Enable Rule Upon Saving**. If you’re not ready to activate the rule yet, create it first. When you’re ready, return to the Security Rules tab and enable your rule from the list. 6. Enter the rule expression using the visual dropdown interface: select a **Field** and an **Operator**. If the field uses a **Value**, then select or enter it. To add conditional logic, use the **And** or **Or** buttons. To manually enter the expression, click **Edit Expression**. To match verified bots or leaked credentials, select one of these fields. - **Known Bot** - **Verified Bot Category** - **Authentication Detected** - **Username Leaked** - **Password Leaked** - **Username and Password Leaked** - **Similar Credentials Leaked** Boolean fields, such as **Known Bot** and the leaked credentials fields, don't include a **Value**. Select **is** or **is not**. If the field matches the request, then the rule action applies. For **Verified Bot Category**, select an operator such as **is in**, then select a category from **Value**. **Known Bot** and **Verified Bot Category** aren't Bot Score or other Cloudflare Bot Management fields. Bot Score and the `cf.bot_management.*` fields require your own Cloudflare setup (orange-to-orange, or O2O) and a Cloudflare Bot Management entitlement. ![Field dropdown on a custom firewall rule showing Known Bot, Verified Bot Category, Authentication Detected, Username Leaked, Password Leaked, Username and Password Leaked, and Similar Credentials Leaked](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_firewall_rule_field_dropdown.png) 7. From **Choose action**, select an action. For example, **Log**, **Skip**, or **Block**. For more information, see [Rule Actions](https://developer.salesforce.com/docs/commerce/commerce-api/guide/cdn-zones-custom-rules.html#rule-actions) in the _B2C Commerce API Developer Guide_. To monitor matching traffic, select **Log**. After you review the results, change the action to **Skip** (to allowlist matching verified bots so later custom rules, rate limiting rules, or WAFv2 rules don't apply), challenge, or **Block**. 8. In **Placement**, select a value from **Select order**. 1. If you select **First**, the eCDN evaluates your rule before any existing rules. 2. If you select **Last**, the eCDN evaluates your rule after any existing rules. 3. If you select **Custom**, place the rule after another existing rule. 9. Click **Save**. ![Bot and Leaked Credentials Expression Fields](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_example.png) Bot and Leaked Credentials Expression Fields When you author a rule expression in Business Manager, select these fields. The same fields are available for custom firewall rules and rate limiting rules. - **Known Bot** (`cf.client.bot`) — Boolean. True when the request is a verified search-engine crawler (Googlebot, Bingbot, and so on). Returns the same result as `cf.bot_management.verified_bot` but, unlike the `cf.bot_management.*` fields, doesn't require a Cloudflare Bot Management entitlement. Use **Known Bot** for verified bot detection. - **Verified Bot Category** (`cf.verified_bot_category`) — String. Identifies the purpose or type of the verified bot and, like **Known Bot**, is available without a Cloudflare Bot Management entitlement. Select a category from **Value**, such as Search Engine Crawler or AI Crawler. Use an operator such as **is in** to match one or more categories. - **Authentication Detected** (`cf.waf.auth_detected`) — Boolean. Cloudflare detects authentication material on the request. - **Username Leaked** (`cf.waf.credential_check.username_leaked`) — Boolean. The submitted username appears in a known leak. - **Password Leaked** (`cf.waf.credential_check.password_leaked`) — Boolean. The submitted password appears in a known leak. - **Username and Password Leaked** (`cf.waf.credential_check.username_and_password_leaked`) — Boolean. The exact username and password pair appears in a known leak. - **Similar Credentials Leaked** (`cf.waf.credential_check.username_password_similar`) — Boolean. A similar version of the username and password credentials detected in the request was previously leaked. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png) Note Boolean fields such as **Known Bot** and the Leaked Credentials Detection fields don't include a **Value**. Select **is** or **is not**. If the field matches the request, then the rule action applies. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png) Note **Known Bot** and **Verified Bot Category** aren't Bot Score or other Cloudflare Bot Management fields. Bot Score and the `cf.bot_management.*` fields require your own Cloudflare setup (orange-to-orange, or O2O) and a Cloudflare Bot Management entitlement. Pair **Known Bot** and **Verified Bot Category** with a custom robots.txt file. Publish crawl policy for AI crawlers in robots.txt, then enforce it with a custom firewall or rate limiting rule. See [Generate a Robots.txt File with Business Manager for B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_generating_a_robots_txt_file.htm&release=264.0.0&type=5 "To create a robots.txt for one or more sites individually, use Business Manager. This robots.txt file is served to any requesting crawlers from the application server. It's stored as a site preference and can be replicated from one instance to another."). This custom firewall rule uses **Known Bot** with **is**, and **Verified Bot Category** with **is in**. The **Value** dropdown lists verified-bot categories. ![New Custom Firewall Rule with Known Bot set to is and Verified Bot Category set to is in, with AI Crawler selected and the Value dropdown listing additional verified-bot categories such as AI Search](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_firewall_rule_verified_bot_category.png) A completed expression matches **Known Bot** and the **AI Crawler**, **AI Search**, and **Search Engine Crawler** categories. This example uses **Log** to monitor matching traffic. After you review the results, change the action to **Skip** to allowlist those bots. ![Completed custom firewall rule named Allowlist Verified bots that matches Known Bot and Verified Bot Category values AI Crawler, AI Search, and Search Engine Crawler, with the Log action](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_firewall_rule_verified_bots.png) ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png) Note Leaked Credentials Detection inspects credentials submitted in login requests. For headless and API logins (SLAS and OCAPI), it scans the `Authorization` header for HTTP Basic Authentication credentials. For browser-based form logins (SFRA `/Account-Login` and storefront `/login`), Salesforce registers a custom detection location on the zone so that the same fields populate for those form logins. Apply the leaked credentials fields on SFRA `/Account-Login`, storefront `/login`, OCAPI login endpoints, and SLAS login (for example, `/shopper/auth/v1/organizations/{organizationId}/oauth2/login`). These fields cover the classic storefront login form and headless integrations. For OCAPI or SLAS logins, a challenge page isn't presented to the shopper. Handle the API response so the shopper receives instructions to reset their password. This custom firewall rule uses leaked credentials fields joined by **And**. Boolean fields leave **Value** empty. ![New Custom Firewall Rule named Leaked Credentials Checks with Username Leaked, Similar Credentials Leaked, Password Leaked, and Username and Password Leaked joined by And, and Value fields empty](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_firewall_rule_leaked_credentials.png) Join leaked credentials fields with **Or** and select **Log** to monitor matching traffic. After you review the results, change the action to **Skip**, challenge, or **Block**. ![Custom firewall rule expression joining Authentication Detected, Username Leaked, Password Leaked, and Username and Password Leaked with Or, Value fields empty, and the Log action](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_firewall_rule_leaked_credentials_log.png) Challenge non-verified bots that hit the storefront cart endpoint, with the `managed_challenge` action. ``` (http.request.uri.path contains "/Cart-AddProduct" and not cf.client.bot) ``` Allow verified search engines through a country-based block, with the `block` action. ``` (ip.src.country in {"CU" "IR"} and not cf.client.bot) ``` Challenge login requests where the submitted password matches a known leak, with the `managed_challenge` action. ``` (http.request.uri.path contains "/Account-Login" and cf.waf.credential_check.password_leaked) ``` After you create the rule, it appears in the list of custom firewall rules on the Security Rules tab. From the list, you can turn the rule on or off (if you selected **Enable Rule Upon Saving**, your rule is on by default). The Custom Firewall Rules list also shows the number of requests that matched each rule in the past 24 hours. Click this number to view detailed traffic analytics. See [Analyze HTTP and Security Traffic for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_analyze_eCDN_traffic.htm&release=264.0.0&type=5 "To get insights into HTTP traffic and security data, use the eCDN Analytics tab in B2C Commerce Business Manager. The Analytics tab shows the Traffic Analysis timeline chart, top traffic statistics across multiple dimensions, and per-rule activity. Switch between HTTP and Security views to see request traffic or firewall events for the same zone and time range.") #### See Also - [Bot Management](https://developer.salesforce.com/docs/commerce/commerce-solutions/guide/bot-management.html)