--- schema_version: "1" id: d63f981f55f574a777165277395ca4aea27bfbf4cdf4bd5c0685ea5df1202763 title: eCDN Web Application Firewall (WAF) collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_waf_protection.md canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_waf_protection.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 9b7130b65cb7d02b4ac86656449ec708f853710361ee210b0e0fe21d8a46d9a8 description: The embedded CDN (eCDN) web application firewall (WAF) is a layer 7 defense that inspects HTTP and HTTPS traffic to your B2C Commerce storefront and blocks requests that try to exploit code-level vulnerabilities. WAF is enabled by default when you create a Proxy Zone and is one part of a multitiered approach to bad-actor mitigation. products: - Commerce - B2C Commerce release: "264" --- # eCDN Web Application Firewall (WAF) The embedded CDN (eCDN) web application firewall (WAF) is a layer 7 defense that inspects HTTP and HTTPS traffic to your B2C Commerce storefront and blocks requests that try to exploit code-level vulnerabilities. WAF is enabled by default when you create a Proxy Zone and is one part of a multitiered approach to bad-actor mitigation. [Which Salesforce Commerce Product Do I Have?](https://help.salesforce.com/s/articleView?id=commerce.comm_what_product.htm&language=en_US) WAF protects production, staging, and development storefront hostnames from common application-layer attacks, such as: - SQL injection - Cross-site scripting (XSS) - Other Open Web Application Security Project (OWASP)–identified threats that target the application layer WAF monitors all HTTP and HTTPS (full-site) and Ajax (small data snippet) requests made to your storefront. Rules can match on request attributes such as user agent, path, country, query string, and IP address. WAF performs several functions to help protect your storefront: - Inspects URLs to detect anything out of the ordinary. - Filters out malicious traffic that attempts to exploit application vulnerabilities. - Helps prevent bad actors from exploiting code vulnerabilities. WAF protection is delivered through two managed rulesets that you enable and tune per zone: the eCDN WAFv2 Managed Ruleset and the OWASP WAFv2 Managed Ruleset. For what each ruleset does, see [eCDN WAF Managed Rulesets](https://help.salesforce.com/s/articleView?id=cc.b2c_waf_managed_rulesets.htm&release=264.0.0&type=5 "The embedded CDN (eCDN) web application firewall (WAF) protects your B2C Commerce storefront through two managed rulesets: the eCDN WAFv2 Managed Ruleset and the OWASP WAFv2 Managed Ruleset. You enable and tune each ruleset per zone."). To turn the rulesets on and set the action for matched requests, see [Configure WAF Settings for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_configure_zone_waf_settings.htm&release=264.0.0&type=5 "Configure web application firewall (WAF) managed rulesets for an eCDN zone for B2C Commerce by using the Security Rules tab in Configure Zones in Business Manager."). Exposed Credentials Check was removed from Embedded CDN Settings in B2C Commerce 26.10. To detect and act on login attempts that use leaked credentials, use Leaked Credentials Detection fields in a custom firewall rule or a rate-limiting rule. See [Create a Custom Firewall Rule for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_create_eCDN_firewall_rule.htm&release=264.0.0&type=5 "Configure a custom firewall rule to control incoming traffic to your B2C Commerce storefront based on specified request parameters.") and [Create a Rate Limiting Rule for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_eCDN_create_rate_limiting_rule.htm&release=264.0.0&type=5 "Configure a rate limiting rule to specify rate limits for requests that match a particular expression and then perform an action when requests reach those rate limits. Rate limiting rules improve B2C Commerce storefront availability, target specific traffic patterns and combat threats, such as bots."). WAF applies on Proxy Zones and on On-Demand Sandbox (ODS) Default Domain zones. For the ODS shared-zone specifics, see [eCDN WAF on On-Demand Sandboxes](https://help.salesforce.com/s/articleView?id=cc.b2c_waf_application.htm&release=264.0.0&type=5 "B2C Commerce On-Demand Sandbox (ODS) Default Domain zones support the full embedded CDN (eCDN) web application firewall (WAF) feature set. Because ODS uses a shared zone model, plan rule changes carefully. The rules apply to every ODS instance in the realm."). To review the traffic WAF acts on, see [eCDN WAF Logs](https://help.salesforce.com/s/articleView?id=cc.b2c_waf_net_traffic_logs.htm&release=264.0.0&type=5 "eCDN logs include information about all of your B2C Commerce network traffic, not just the traffic that the web application firewall (WAF) acts on. Use the logs to track IP-reputation–blocked traffic and to see how much of your traffic doesn't trigger WAF."). - WAF can stop a bot that tries to exploit common code vulnerabilities. However, WAF can miss a bot that brute-forces coupon codes, because that request is a legitimate HTTP and web-form request. For bot-specific management, contact your account team about our recommended bot-mitigation partners. - Each managed ruleset can be turned on or off as a whole. You can't customize individual rules within a managed ruleset. - **[eCDN WAF Managed Rulesets](https://help.salesforce.com/s/articleView?id=cc.b2c_waf_managed_rulesets.htm&release=264.0.0&type=5)** The embedded CDN (eCDN) web application firewall (WAF) protects your B2C Commerce storefront through two managed rulesets: the eCDN WAFv2 Managed Ruleset and the OWASP WAFv2 Managed Ruleset. You enable and tune each ruleset per zone. - **[eCDN WAF on On-Demand Sandboxes](https://help.salesforce.com/s/articleView?id=cc.b2c_waf_application.htm&release=264.0.0&type=5)** B2C Commerce On-Demand Sandbox (ODS) Default Domain zones support the full embedded CDN (eCDN) web application firewall (WAF) feature set. Because ODS uses a shared zone model, plan rule changes carefully. The rules apply to every ODS instance in the realm. - **[eCDN WAF Logs](https://help.salesforce.com/s/articleView?id=cc.b2c_waf_net_traffic_logs.htm&release=264.0.0&type=5)** eCDN logs include information about all of your B2C Commerce network traffic, not just the traffic that the web application firewall (WAF) acts on. Use the logs to track IP-reputation–blocked traffic and to see how much of your traffic doesn't trigger WAF.