---
schema_version: "1"
id: 40913df0e12a61ffcb3047a344ff1d77faccfe278fb85fdd008cc788040dab34
title: Implement Enhanced Security Controls in Commerce Cloud
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/commerce/264-0-0/b2c_rn_implement_enhanced_security_in_commerce_cloud.md
canonical_url: https://help.salesforce.com/s/articleView?id=commerce.b2c_rn_implement_enhanced_security_in_commerce_cloud.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 00f08263036ca30416e4dba1a66bcc7592d48445c059bd5575f5b3119c664377
description: Commerce Cloud is implementing a new security measure that blocks traffic to staging instances that doesn’t originate from Commerce Cloud eCDN from accessing the hyphenated demandware.net hostname. This change rejects all calls using ‌hyphenated hostnames, such as staging-, to access the Open Commerce API (OCAPI) or Storefront.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Implement Enhanced Security Controls in Commerce Cloud

Commerce Cloud is implementing a new security measure that blocks traffic to staging instances that doesn’t originate from Commerce Cloud eCDN from accessing the hyphenated demandware.net hostname. This change rejects all calls using ‌hyphenated hostnames, such as staging-, to access the Open Commerce API (OCAPI) or Storefront.

**When:** This change becomes effective on October 7, 2024.

**Why:** Currently, traffic through `demandware.net` doesn’t have eCDN controls in place, posing a potential risk to your data security. Origin Shielding for staging is crucial to make sure that all external traffic goes through the eCDN security layers before reaching your environment.

The introduction of Origin Shielding for staging impacts Commerce Cloud customers who currently have implementations that involve direct calls to POD IPs.

**How:** To prepare for this upcoming change, Salesforce requests customers take these actions:

- Evaluate your current implementations for calls made to OCAPI or Storefront using direct POD IPs, dot-form hostnames, or hyphenated hostnames for `demandware.net`. For example, `staging.xxx.demandware.net` or `staging-xxx.demandware.net`.
- Update services or applications to use the vanity hostname and route traffic through eCDN.

You can create a proxy zone on Staging instances through the Business Manager and configure a custom hostname with an automatically renewing eCDN Managed certificate for added protection.

For further assistance, contact your Customer Service Manager (CSM).

#### See Also

- [Configure eCDN for Staging in Business Manager](https://help.salesforce.com/s/articleView?id=commerce.rn_b2c_rn_configure_ecdn_for_staging_in_bm.htm&type=5&language=en_US)
- [Create a Zone in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_creating_a_zone.htm&language=en_US)
- [Add an SSL Certificate to an eCDN Zone and Configure DNA Mapping](https://help.salesforce.com/s/articleView?id=cc.b2c_add_a_certificate_to_a_zone.htm&language=en_US)
- [Use the CDN Zones API to Configure eCDN](https://help.salesforce.com/s/articleView?id=cc.b2c_use_cdn_zones_api_to_configure_ecdn.htm&language=en_US)