---
schema_version: "1"
id: 25e5a91587c75fdbb247c6b71e29baf0f46b5854a996d25a1477c6225f357e83
title: Protect OCAPI Integrations with Under Attack Mode
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/264-0-0/rn_b2c_under_attack_mode_ocapi.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_b2c_under_attack_mode_ocapi.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 69e3359078054cccf5197696c55e4592b8582f2c3df19e82b43c6a302119f231
description: When you turn on Under Attack Mode for an eCDN storefront zone, selected Open Commerce API (OCAPI) requests continue without a browser challenge. You can protect storefront pages during an attack without interrupting OCAPI integrations that use the exempt paths. Calls to other storefront paths can still be challenged, so use targeted custom rules and rate limiting when you need to protect those paths.
products:
  - Cross Cloud
release: "264"
---
# Protect OCAPI Integrations with Under Attack Mode

When you turn on Under Attack Mode for an eCDN storefront zone, selected Open Commerce API (OCAPI) requests continue without a browser challenge. You can protect storefront pages during an attack without interrupting OCAPI integrations that use the exempt paths. Calls to other storefront paths can still be challenged, so use targeted custom rules and rate limiting when you need to protect those paths.

**Where:** This change applies to B2C Commerce.

**How:** In Business Manager, click **Administration** | **Sites** | **Embedded CDN Settings**. Open the zone menu, select **Configure Zone**, and turn on **Under Attack Mode**.

Under Attack Mode presents a browser check to every unique visitor to storefront pages but doesn't challenge these OCAPI requests:

- Shop, Data, Meta, and Batch API requests
- Dynamic Imaging Service URLs
- The OCAPI access-token endpoint

Under Attack Mode isn't available on SCAPI zones, so calls to your SCAPI hostname aren't affected. Server-to-server, headless, and mobile calls to other storefront paths, such as custom controllers and webhooks, can still be challenged and fail while Under Attack Mode is on. For path-specific attacks, use pretested custom rules with a Managed Challenge action for cart and checkout page loads and rate-limiting rules for add-to-cart and order-submission requests.

#### See Also

- [_Salesforce Help_: Enable Under Attack Mode for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_enable_under_attack_mode.htm&type=5&language=en_US)