---
schema_version: "1"
id: 9193072ea377fe5ca4dc572daac5fd53076dda9901ae0e1c8cbd2c82c6f494af
title: Implement Enhanced Security Controls in Commerce Cloud
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/commerce/264-0-0/b2c_rn_implement_enhanced_security.md
canonical_url: https://help.salesforce.com/s/articleView?id=commerce.b2c_rn_implement_enhanced_security.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: deecc77839b37301608eb27a856510c7249c6fc340d65fa0f7d7cfc76b4677ce
description: As announced in the 24.7 release notes, B2C Commerce now prevents traffic that doesn’t originate from Commerce Cloud eCDN from accessing hyphenated demandware.net host names, such as staging-xxx.demandware.net, to the Open Commerce API (OCAPI) or Storefront. Traffic through demandware.net doesn’t have eCDN controls in place, posing a potential risk to your data security. Origin Shielding for staging makes sure that all external traffic goes through the eCDN security layers before reaching your environment. The introduction of Origin Shielding for staging impacts Commerce Cloud customers who have implementations that involve direct calls to POD IPs.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Implement Enhanced Security Controls in Commerce Cloud

As announced in the 24.7 release notes, B2C Commerce now prevents traffic that doesn’t originate from Commerce Cloud eCDN from accessing hyphenated demandware.net host names, such as `staging-xxx.demandware.net`, to the Open Commerce API (OCAPI) or Storefront. Traffic through `demandware.net` doesn’t have eCDN controls in place, posing a potential risk to your data security. Origin Shielding for staging makes sure that all external traffic goes through the eCDN security layers before reaching your environment. The introduction of Origin Shielding for staging impacts Commerce Cloud customers who have implementations that involve direct calls to POD IPs.

**When:** This change takes effect on October 7, 2024.

**How:** To prepare for this upcoming change:

- Evaluate your implementations for calls made to OCAPI or Storefront using direct POD IPs, dot-form host names, or hyphenated host names for `demandware.net`, for example, `staging.xxx.demandware.net` or `staging-xxx.demandware.net`.
- Update services or applications to use the vanity host name and route traffic through eCDN.

You can create a proxy zone on staging instances through Business Manager and configure a custom host name with an automatically renewing eCDN managed certificate for added protection.

For further assistance, contact your Customer Service Manager.