---
schema_version: "1"
id: 0329c470af6054960ad1aa4a703481ab611f1ada01162721d04d91fe30d0be9b
title: Storefront Network Access in B2C Commerce
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_storefront_network_access.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_storefront_network_access.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 54939b75bb497ceb51430cb376d27d713dc61d23e6a9593dedf8676c9903ddcb
description: To limit network access to a storefront, configure the embedded Content Delivery Network (eCDN) that comes with B2C Commerce. eCDN is self-service in Business Manager.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Storefront Network Access in B2C Commerce

To limit network access to a storefront, configure the embedded Content Delivery Network (eCDN) that comes with B2C Commerce. eCDN is self-service in Business Manager.

The eCDN includes Web application firewall (WAF) and IP firewall features to protect against denial of service attacks. The eCDN organizes its configuration around zones. Configure eCDN for a specific zone or globally for all zones.

Salesforce auto-provisions a SCAPI zone (`<shortcode>.api.commercecloud.salesforce.com`) with eCDN. There's no separate enablement step, and you can't create, remove, or add hostnames to a SCAPI zone. There's one SCAPI zone for Development, Staging, and Production. Configure it only from the Production instance. It doesn't appear in Business Manager or the CDN API on Development or Staging. A network-access control applied on Production affects all three environments unless you scope it by org ID. See [SCAPI Zone Support for B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_scapi_zone.htm&release=264.0.0&type=5 "A SCAPI zone is the Salesforce-managed eCDN zone that fronts Salesforce Commerce API (SCAPI) traffic. Starting with B2C Commerce 26.10, the Production instance includes a subset of eCDN security controls and analytics for this zone in Business Manager and the CDN API, with no support case required.").

In either case, you can configure firewall allowlists and blocklists for specific IP addresses and ranges. You can also configure an IP security level that uses a visitor’s IP reputation, calculated using an internal algorithm, to decide whether to require the user to solve a Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA) challenge before logging in. A CAPTCHA challenge is especially useful against automated attacks. At the highest security level, all visitors must respond to a CAPTCHA challenge before proceeding.

The eCDN WAF analyzes and interprets your HTTP/S traffic to protect your storefront. WAF stops application-level attacks that attempt to exploit code-level vulnerabilities. These types of attacks include cross-site scripting (XSS) and SQL injection.

You can configure action modes, including Simulate, Challenge, and Block, to determine how to respond to an OWASP threat. Similar to IP firewall settings, the Challenge action presents a CAPTCHA challenge to the suspected attacker before they can proceed to your storefront.