---
schema_version: "1"
id: 1d74bafeefc4e452e516fc7ed711082d7c9600e37a2de338bcb6d818fe219ec3
title: Denial-of-Service Protection in B2C Commerce
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_denial_of_service_protection.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_denial_of_service_protection.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: f274f7f5abd176c7dafeff05c15a346c390f78b42b198545ce0a380cb311d96d
description: In a denial-of-service (DoS) attack, the attacker attempts to deny computer resources to a network’s users. Attackers usually accomplish this by overwhelming the target computer system’s resources with unauthorized requests, which prevent valid users from accessing the network.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Denial-of-Service Protection in B2C Commerce

In a denial-of-service (DoS) attack, the attacker attempts to deny computer resources to a network’s users. Attackers usually accomplish this by overwhelming the target computer system’s resources with unauthorized requests, which prevent valid users from accessing the network.

In a distributed denial-of-service (DDoS) attack, the attack comes from many sources instead of a single intruder. The primary mechanism used to mitigate the impact of a DoS attack is the eCDN, which provides DoS and DDoS protection. The eCDN offers automatic protection against a range of TCP floods, including SYN, UDP, and ICMP attacks. The eCDN can also lessen the impact of DoS attacks. To do so, configure the following: - IP firewall rules - web application firewall (WAF) rule - eCDN security levels - Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA) challenges

Mitigate credential stuffing attacks with Leaked Credentials Detection and rate limiting, and with customer and user login lockout policies. Create a custom firewall rule or a rate-limiting rule that uses the Leaked Credentials Detection fields. See [Create a Custom Firewall Rule for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_create_eCDN_firewall_rule.htm&release=264.0.0&type=5 "Configure a custom firewall rule to control incoming traffic to your B2C Commerce storefront based on specified request parameters.") and [Create a Rate Limiting Rule for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_eCDN_create_rate_limiting_rule.htm&release=264.0.0&type=5 "Configure a rate limiting rule to specify rate limits for requests that match a particular expression and then perform an action when requests reach those rate limits. Rate limiting rules improve B2C Commerce storefront availability, target specific traffic patterns and combat threats, such as bots."). Use rate-limiting functionality for custom code used to develop a web service.

When account-level trusted IP lists are configured for storefront eCDN zones, Salesforce automatically applies DDoS Layer 7 overrides on those zones to prevent false-positive challenges on high-volume traffic from trusted sources. These overrides set a reduced sensitivity level and log-only action on specific Cloudflare DDoS managed rules. No additional configuration is required. For details, see [DDoS Layer 7 override details](https://help.salesforce.com/s/articleView?id=cc.b2c_ecdn_security_rules.htm&release=264.0.0&type=5).

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png)

Note The DDoS Layer 7 override behavior described here is confirmed for storefront eCDN zones. It isn't confirmed for SCAPI zones. For the eCDN controls available on SCAPI zones, see [SCAPI Zone Support for B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_scapi_zone.htm&release=264.0.0&type=5 "A SCAPI zone is the Salesforce-managed eCDN zone that fronts Salesforce Commerce API (SCAPI) traffic. Starting with B2C Commerce 26.10, the Production instance includes a subset of eCDN security controls and analytics for this zone in Business Manager and the CDN API, with no support case required.").