---
schema_version: "1"
id: 8d58d00f618cd1d3ddedb49025c5c241974576fabee08ae093b6eadd0e5e69ce
title: Protect Against Bots and Malicious Attacks
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/commerce/264-0-0/rn_b2c_origin_shielding_phase2_je.md
canonical_url: https://help.salesforce.com/s/articleView?id=commerce.rn_b2c_origin_shielding_phase2_je.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 57c3c083e747b84a1bc3aa1c6ee3b1bb211ecefee58e9f54847237ea21dd63ec
description: To help you protect your B2C Commerce environments from bots and malicious attacks, Commerce Cloud is restricting external sources from directly accessing the demandware.net hostname.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Protect Against Bots and Malicious Attacks

To help you protect your B2C Commerce environments from bots and malicious attacks, Commerce Cloud is restricting external sources from directly accessing the demandware.net hostname.

When: Beginning April 15, 2022, we’ll roll out the origin shielding changes in three phases.

- Phase 1 April 15, 2022–The change is enforced to all newly created production and development realms. New B2C Commerce production and development instances reject all calls made to hyphenated hostnames with a `*.demandware.net` format.
- Phase 2 May 15, 2022–The change is enforced to all existing development instances. All development instances reject calls made to hyphenated hostnames with the `development-xxx-customer.demandware.net` format.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-commerce-b2c_commerce_release_notes-264-0-0-production-enus/4ec7e638-d25e-4c65-96ec-ec874bcf5183/images/icon_note.png)
    
    Note During this phase, we recommend that you test development instances to determine if any services or applications are impacted, and require updates.
- Phase 3 August 15, 2022–The change is enforced to all existing production instances. All production instances reject calls being made to hyphenated hostnames with the `production-xxx-customer.demandware.net` format.
    
    ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-commerce-b2c_commerce_release_notes-264-0-0-production-enus/4ec7e638-d25e-4c65-96ec-ec874bcf5183/images/icon_note.png)
    
    Note No extensions are granted. This security rollout is part of the 2022 Holiday preparation.

How: Beginning April 15, 2022, Traffic is restricted from accessing the demandware.net hostname. This change rejects all calls accessing production and development instances. Impact to your storefront can include disruption on third-party calls and other implementations. To eliminate the impact of this change, modify your implementation as follows.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-commerce-b2c_commerce_release_notes-264-0-0-production-enus/4ec7e638-d25e-4c65-96ec-ec874bcf5183/images/icon_note.png)

Note Traffic from Business Manager is considered internal to the Salesforce Commerce Cloud system. You can continue to access Business Manager using hostnames in the dash format for `demandware.net`. For example, Business Manager `production-realm-customer.demandware.net`, and other hostnames in the dash format for `demandware.net` aren’t restricted by this change.

- Update services or applications that use hostnames in the dash format for demandware.net so they direct traffic through a vanity hostname. For example, change `production-realm-customer.demandware.net` to `brand.com` or `www.brand.com`
- Switch all Salesforce Commerce Cloud service integration and secure connections to Server Name Indication (SNI).
    
    Non-SNI traffic is impacted as demandware.net is restricted. Work with your browser, point-of-sale, mobile app, or third-party vendor or provider to ensure they can use SNI for API requests to eCDN.
- During Phase 2, test development instances to determine if any services or applications are impacted, and require updates.