eCDN Zone Security Rules

What the Security Rules Tab Covers in B2C Commerce

The Security Rules tab on the B2C Commerce Configure Zone screen groups the controls that decide which requests reach your storefront and how suspicious traffic is handled. Page Shield policies and host header override rules appear on their own tabs in the Configure Zone screen but are part of the same zone-security workflow.

Example: Rate Limit Logins That Use Leaked Credentials

Exposed Credentials Check was removed from WAF Rules in B2C Commerce 26.10. To act on leaked credentials, use Leaked Credentials Detection fields in a custom firewall rule or a rate-limiting rule. This rate-limiting rule issues a Managed Challenge for 1 hour to every /Account-Login POST request from an IP address that submitted two leaked username and password pairs in the last minute.

• Rule Name: Rate Limit Leaked Credentials
• Set Rate Limit: 2 requests per minute
• Use Custom Counting Expression: selected
• Matching Characteristics: IP with NAT support
• Choose action: Managed Challenge
• Action for Selected Duration: 1 hour

Rule expression:

(ends_with(http.request.uri.path, "/Account-Login") and http.request.method eq "POST")

Counting expression:

(ends_with(http.request.uri.path, "/Account-Login") and http.request.method eq "POST" and cf.waf.credential_check.username_and_password_leaked)

For the Leaked Credentials Detection fields and a custom firewall rule example, see Create a Custom Firewall Rule for an eCDN Zone and Create a Rate Limiting Rule for an eCDN Zone.

Behavior: What Traffic Is Bypassed

When a request comes from an IP address in a trusted (Managed IP Address) list and matches a skip rule, the eCDN for B2C Commerce bypasses selected security checks. The core purpose, making sure that traffic from trusted IP addresses isn't blocked, is preserved from the legacy Trusted IP model. The new model implements it more precisely.

Tip Skip rules are evaluated before any blocking or rate-limiting rules and are automatically positioned at the top of the ruleset. If both an allowlist skip rule and a blocklist rule exist for a zone, the allowlist skip rule is positioned first. You don't need to manage rule ordering manually.

DDoS Layer 7 Override Details

When an account has account-level (realm-level) trusted IP lists configured, B2C Commerce automatically applies DDoS Layer 7 overrides on all eligible zones. These overrides are separate from the skip rule applied to custom firewall rules, WAF rules, and rate limiting rules. They're set to sensitivity_level: off and action: log to prevent false-positive challenges on legitimate high-volume traffic from trusted sources.

The following Cloudflare DDoS managed rules are automatically overridden:

Important When an account has account-level trusted IPs, DDoS Layer 7 overrides apply to eligible storefront zone types: Proxy, Legacy, Default Domain, and Business Manager (BM) zones. This overall rule is broader than zone-level skip rules, which don't apply to Business Manager and SCAPI zones. Whether these Layer 7 overrides apply to SCAPI zones isn't confirmed.

Zone Type Eligibility

The following zone types for B2C Commerce support Realm Security Rules (same as legacy Trusted IP support):

• Proxy zones
• Legacy zones (custom domains)
• Default Domain zones

Feature Switch

Realm Security Rules are controlled by a feature switch in B2C Commerce Business Manager. When the Enable eCDN Trusted IP Migration feature switch is enabled, the Security Rules tab with the Managed IP Address Lists and Custom Firewall Rules functionality becomes available in the Configure Zones interface. Contact your Salesforce account team if this tab isn't visible in your organization.