Got a Docker Compose file? Your project goes live in seconds — one command on cdn.com.tr. See how Code on GitHub? Every push auto-deploys to cdn.com.tr — connect your repo and ship. See how

CDN.com.tr Help

Manage Bot Protection (JS Challenge)

Enable the three-mode bot verification from the Security page, use "Everyone" deliberately, read the pass rate.

Cache, security, WAF, and purge

Manage Bot Protection (JS Challenge)

Enable the three-mode bot verification from the Security page, use "Everyone" deliberately, read the pass rate.

Deep-dive reading

This page covers panel usage; what JS Challenge is, which attack class it stops, and how it works alongside WAF/DDoS lives in the guides.

DDoS protection and bot floods

The JS Challenge layer explained with live pilot results: how risky visitors are picked and how verification works.

Read the guide

WAF and bot verification together

The WAF inspects the request, JS Challenge verifies the client — how the three security layers complete each other at the edge.

Read the guide

Use cases

A customer's site is drowning in scraping bots or an application-layer bot flood; they want the bots cut without touching real visitors.

Workflow

  1. Select the account and open Protection → Security.
  2. On the Bot Protection card pick "Risky visitors" (recommended).
  3. Enable "Everyone" only during an attack, temporarily, confirming the warning dialog.
  4. Watch the pass rate in the verification statistics: near 0% means what was cut were bots.

Checks

  • A mode change reaches the edges automatically within minutes; no separate Apply Changes needed.
  • Verified search engines (Google, Bing, Yandex, Apple) are never blocked in any mode.
  • "Everyone" also cuts the customer's own API and mobile clients — never leave it on permanently.