---
schema_version: "1"
id: beb4e62a61433cf8a7eb314bc7c53454c28567280371d3af86e8d50e696ab078
title: eCDN Zone Security Rules
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_ecdn_security_rules.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_ecdn_security_rules.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: b257f14312808340cedd3a6b3b935cd9f3583753482983650f9b8f5bd6c6a579
description: Use the Security Rules tab on the Configure Zone screen to protect a B2C Commerce embedded CDN (eCDN) zone with web application firewall (WAF) managed rulesets, realm and zone security rules, custom firewall rules, and rate limiting. Learn what each control does, which zone types are eligible, and how traffic from trusted sources bypasses security checks.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# eCDN Zone Security Rules

Use the Security Rules tab on the Configure Zone screen to protect a B2C Commerce embedded CDN (eCDN) zone with web application firewall (WAF) managed rulesets, realm and zone security rules, custom firewall rules, and rate limiting. Learn what each control does, which zone types are eligible, and how traffic from trusted sources bypasses security checks.

[Which Salesforce Commerce Product Do I Have?](https://help.salesforce.com/s/articleView?id=commerce.comm_what_product.htm&language=en_US)

## What the Security Rules Tab Covers in B2C Commerce

The Security Rules tab on the B2C Commerce Configure Zone screen groups the controls that decide which requests reach your storefront and how suspicious traffic is handled. Page Shield policies and host header override rules appear on their own tabs in the Configure Zone screen but are part of the same zone-security workflow.

| Control | What it does | For more information |
| --- | --- | --- |
| WAF managed rulesets | Enable Salesforce-managed rule packages (the eCDN WAFv2 Managed Ruleset and the OWASP WAFv2 Managed Ruleset) that block common attack patterns. | [Configure WAF Settings for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_configure_zone_waf_settings.htm&release=264.0.0&type=5 "Configure web application firewall (WAF) managed rulesets for an eCDN zone for B2C Commerce by using the Security Rules tab in Configure Zones in Business Manager.") |
| Realm Security Rules | Manage IP address lists and custom firewall rules that apply across all eligible zones in your realm. Replaces the legacy Trusted IP configuration. | [Realm Security Rules for eCDN Zones](https://help.salesforce.com/s/articleView?id=cc.b2c_configure_zone_realm_security_rules.htm&release=264.0.0&type=5 "Realm Security Rules let you define Managed IP Address Lists and custom firewall rules that control how trusted IP traffic is handled across all your eCDN zones for B2C Commerce. These rules replace the legacy Trusted IP configuration.") |
| Custom firewall rules | Match requests by IP, geography, header, or other criteria and choose an action, such as block, challenge, or skip. | [Create a Custom Firewall Rule for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_create_eCDN_firewall_rule.htm&release=264.0.0&type=5 "Configure a custom firewall rule to control incoming traffic to your B2C Commerce storefront based on specified request parameters.") |
| Rate limiting rules | Throttle or block clients that exceed a request threshold in a time window. | [Create a Rate Limiting Rule for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_eCDN_create_rate_limiting_rule.htm&release=264.0.0&type=5 "Configure a rate limiting rule to specify rate limits for requests that match a particular expression and then perform an action when requests reach those rate limits. Rate limiting rules improve B2C Commerce storefront availability, target specific traffic patterns and combat threats, such as bots.") |
| Page Shield policies | Monitor and control the client-side scripts and connections that run on your storefront. | [Configure a Page Shield Policy for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_configure_eCDN_page_shield_policy.htm&release=264.0.0&type=5 "Set up a Page Shield policy to make sure only trusted scripts run on sensitive store pages like cart and checkout. A Page Shield policy helps detect client-side script changes and supply chain risks, and helps your B2C Commerce store comply with the Payment Card Industry Data Security Standard (PCI DSS) 4.0.1 client-side security requirements.") |
| Host header override rules | Rewrite the Host header for matching requests so they route to the correct origin. | [Configure a Host Header Override Rule for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_eCDN_configure_host_header_override.htm&release=264.0.0&type=5 "To support a single hostname across multiple realms, create a Host Header Override Rule for B2C Commerce sites that use an external content delivery network (CDN). This rule replaces unique hostnames with a common hostname to maintain the single-hostname setup. If you reuse a hostname, traffic can be unintentionally served from a different realm.") |

## Example: Rate Limit Logins That Use Leaked Credentials

Exposed Credentials Check was removed from WAF Rules in B2C Commerce 26.10. To act on leaked credentials, use Leaked Credentials Detection fields in a custom firewall rule or a rate-limiting rule. This rate-limiting rule issues a **Managed Challenge** for 1 hour to every `/Account-Login` POST request from an IP address that submitted two leaked username and password pairs in the last minute.

- **Rule Name**: Rate Limit Leaked Credentials
- **Set Rate Limit**: 2 requests per minute
- **Use Custom Counting Expression**: selected
- **Matching Characteristics**: IP with NAT support
- **Choose action**: **Managed Challenge**
- **Action for Selected Duration**: 1 hour

Rule expression:

```
(ends_with(http.request.uri.path, "/Account-Login") and http.request.method eq "POST")
```

Counting expression:

```
(ends_with(http.request.uri.path, "/Account-Login") and http.request.method eq "POST" and cf.waf.credential_check.username_and_password_leaked)
```

For the Leaked Credentials Detection fields and a custom firewall rule example, see [Create a Custom Firewall Rule for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_create_eCDN_firewall_rule.htm&release=264.0.0&type=5 "Configure a custom firewall rule to control incoming traffic to your B2C Commerce storefront based on specified request parameters.") and [Create a Rate Limiting Rule for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_eCDN_create_rate_limiting_rule.htm&release=264.0.0&type=5 "Configure a rate limiting rule to specify rate limits for requests that match a particular expression and then perform an action when requests reach those rate limits. Rate limiting rules improve B2C Commerce storefront availability, target specific traffic patterns and combat threats, such as bots.").

## Behavior: What Traffic Is Bypassed

When a request comes from an IP address in a trusted (Managed IP Address) list and matches a skip rule, the eCDN for B2C Commerce bypasses selected security checks. The core purpose, making sure that traffic from trusted IP addresses isn't blocked, is preserved from the legacy Trusted IP model. The new model implements it more precisely.

![Tip](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_tip.png)

Tip Skip rules are evaluated before any blocking or rate-limiting rules and are automatically positioned at the top of the ruleset. If both an allowlist skip rule and a blocklist rule exist for a zone, the allowlist skip rule is positioned first. You don't need to manage rule ordering manually.

| Security check | Legacy behavior (Trusted IP groups) | New behavior (WAF custom rules + skip actions) |
| --- | --- | --- |
| Custom firewall rules | Bypassed | Bypassed |
| WAF managed rules | Bypassed | Bypassed |
| Rate limiting rules | Bypassed | Bypassed |
| DDoS Layer 7 protections | Bypassed | Automatically adjusted (sensitivity reduced for trusted sources). No additional configuration required. |
| Bot management | Bypassed | Not bypassed by default. Evaluate whether your use case requires this and configure accordingly. |

## DDoS Layer 7 Override Details

When an account has account-level (realm-level) trusted IP lists configured, B2C Commerce automatically applies DDoS Layer 7 overrides on all eligible zones. These overrides are separate from the skip rule applied to custom firewall rules, WAF rules, and rate limiting rules. They're set to `sensitivity_level: off` and `action: log` to prevent false-positive challenges on legitimate high-volume traffic from trusted sources.

The following Cloudflare DDoS managed rules are automatically overridden:

 
| Rule ID | Description |
| --- | --- |
| `0b1e17bd25c74e38834f19043486aee1` | Unusual headers/URI path signature #1 |
| `466d6c2e8ba74459a2670e91e269dfd6` | Unusual headers/URI path signature #56 |
| `12b9aecf1f6245b29d7e842bf35a42a0` | Unusual headers/URI path signature #57 |
| `6e3ccc23900c428e8ec0fb8a3a679c52` | Requests from known bad sources |
| `d38bbe6dc925461ca4e47e4cecd68c61` | High request rate to search endpoints |
| `0a07c24f3cd44a57a5c19b73d2f294d7` | Requests trying to impersonate browsers |

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_important.png)

Important When an account has account-level trusted IPs, DDoS Layer 7 overrides apply to eligible storefront zone types: Proxy, Legacy, Default Domain, and Business Manager (BM) zones. This overall rule is broader than zone-level skip rules, which don't apply to Business Manager and SCAPI zones. Whether these Layer 7 overrides apply to SCAPI zones isn't confirmed.

## Zone Type Eligibility

The following zone types for B2C Commerce support Realm Security Rules (same as legacy Trusted IP support):

- Proxy zones
- Legacy zones (custom domains)
- Default Domain zones

## Feature Switch

Realm Security Rules are controlled by a feature switch in B2C Commerce Business Manager. When the **Enable eCDN Trusted IP Migration** feature switch is enabled, the Security Rules tab with the Managed IP Address Lists and Custom Firewall Rules functionality becomes available in the Configure Zones interface. Contact your Salesforce account team if this tab isn't visible in your organization.

- **[Configure WAF Settings for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_configure_zone_waf_settings.htm&release=264.0.0&type=5)**  
    Configure web application firewall (WAF) managed rulesets for an eCDN zone for B2C Commerce by using the Security Rules tab in Configure Zones in Business Manager.
- **[Realm Security Rules for eCDN Zones](https://help.salesforce.com/s/articleView?id=cc.b2c_configure_zone_realm_security_rules.htm&release=264.0.0&type=5)**  
    Realm Security Rules let you define Managed IP Address Lists and custom firewall rules that control how trusted IP traffic is handled across **all** your eCDN zones for B2C Commerce. These rules replace the legacy Trusted IP configuration.
- **[Create a Custom Firewall Rule for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_create_eCDN_firewall_rule.htm&release=264.0.0&type=5)**  
    Configure a custom firewall rule to control incoming traffic to your B2C Commerce storefront based on specified request parameters.
- **[Create a Rate Limiting Rule for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_eCDN_create_rate_limiting_rule.htm&release=264.0.0&type=5)**  
    Configure a rate limiting rule to specify rate limits for requests that match a particular expression and then perform an action when requests reach those rate limits. Rate limiting rules improve B2C Commerce storefront availability, target specific traffic patterns and combat threats, such as bots.

#### See Also

- [Secure Your Site](https://developer.salesforce.com/docs/commerce/commerce-api/guide/security.html)