When you turn on Under Attack Mode for an eCDN storefront zone, selected Open Commerce API (OCAPI) requests continue without a browser challenge. You can protect storefront pages during an attack without interrupting OCAPI integrations that use the exempt paths. Calls to other storefront paths can still be challenged, so use targeted custom rules and rate limiting when you need to protect those paths.
Where: This change applies to B2C Commerce.
How: In Business Manager, click . Open the zone menu, select Configure Zone, and turn on Under Attack Mode.
Under Attack Mode presents a browser check to every unique visitor to storefront pages but doesn't challenge these OCAPI requests:
- Shop, Data, Meta, and Batch API requests
- Dynamic Imaging Service URLs
- The OCAPI access-token endpoint
Under Attack Mode isn't available on SCAPI zones, so calls to your SCAPI hostname aren't affected. Server-to-server, headless, and mobile calls to other storefront paths, such as custom controllers and webhooks, can still be challenged and fail while Under Attack Mode is on. For path-specific attacks, use pretested custom rules with a Managed Challenge action for cart and checkout page loads and rate-limiting rules for add-to-cart and order-submission requests.