---
schema_version: "1"
id: 0ceb20ceb5e50422af6684c28db7aaaddf70ce9e22a8a3475bd555dc30f19a7d
title: eCDN WAF on On-Demand Sandboxes
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_waf_application.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_waf_application.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 0d0bdc8d076637d0c9cd2dbd0345b674e051ea5f3b7b8cc01eb95286ce391647
description: B2C Commerce On-Demand Sandbox (ODS) Default Domain zones support the full embedded CDN (eCDN) web application firewall (WAF) feature set. Because ODS uses a shared zone model, plan rule changes carefully. The rules apply to every ODS instance in the realm.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# eCDN WAF on On-Demand Sandboxes

B2C Commerce On-Demand Sandbox (ODS) Default Domain zones support the full embedded CDN (eCDN) web application firewall (WAF) feature set. Because ODS uses a shared zone model, plan rule changes carefully. The rules apply to every ODS instance in the realm.

[Which Salesforce Commerce Product Do I Have?](https://help.salesforce.com/s/articleView?id=commerce.comm_what_product.htm&language=en_US)

All standard WAF capabilities are available on ODS Default Domain zones, including the OWASP ruleset, the eCDN Managed ruleset, custom firewall rules, bot protection, DDoS mitigation, and rate limiting. Configure these settings through the Business Manager eCDN UI or the CDN API. For information about what each managed ruleset does, see [eCDN WAF Managed Rulesets](https://help.salesforce.com/s/articleView?id=cc.b2c_waf_managed_rulesets.htm&release=264.0.0&type=5 "The embedded CDN (eCDN) web application firewall (WAF) protects your B2C Commerce storefront through two managed rulesets: the eCDN WAFv2 Managed Ruleset and the OWASP WAFv2 Managed Ruleset. You enable and tune each ruleset per zone.").

Because ODS uses a shared zone model, WAF rules configured on the zone apply to all ODS instances in the realm. Rules aren't scoped per instance, so plan rule changes carefully to avoid unintended impact across instances.

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_important.png)

Important ODS zones don't have a default Block All firewall rule. Unlike some production zones, ODS zones are open by default. Add explicit rules as needed to restrict access.

For more information about Default Domain availability on ODS and the shared zone model, see [Default Domain Support for B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_default_domain.htm&language=en_US).