Manage Bot Protection (JS Challenge)
Enable the three-mode bot verification from the Security page, use "Everyone" deliberately, read the pass rate.
CDN.com.tr Help
Cache, security, WAF, and purge
Use this section when content is stale, traffic is blocked, a redirect is unexpected, or a purge needs status tracking.
Cache, security, WAF, and purge
This section covers how the CDN stores, protects and refreshes your content — the three things that decide whether visitors get a fast, safe and up-to-date site. Cache rules control what is cached and for how long, security controls and the WAF filter out malicious traffic, and purge clears cached content the moment you publish a change.
Caching is what makes a CDN fast: a cached response is served from the edge, close to the visitor, without touching your origin server. You shape it with cache rules — the cache key, TTL, which HTTP methods and status codes to cache, and header/cookie handling — and you confirm it is working by reading the X-Proxy-Cache-MT response header, which shows HIT, MISS, BYPASS or EXPIRED for every request.
Security runs at the same edge. The WAF (Web Application Firewall) blocks common attacks such as SQL injection and cross-site scripting before they ever reach your server, and the WAF logs let you see exactly what was blocked or challenged and why. When content looks stale after an update, a purge removes the old copy from the edge cache so the next visitor gets the new version immediately.
Use cases
- A customer updates CSS but sees old content.
- A WAF event blocks legitimate traffic.
- A redirect loop appears after a rule change.
Workflow
- Select account.
- Open Advanced Management or Purge.
- Change only the relevant rule/action.
- Apply changes or watch purge status.
Checks
- Rule belongs to selected account.
- Purge path is valid.
- WAF log filters match the selected account/time range.
Topics
The Security page: WAF, IP and country blocking, hotlink, rate limit
All account-level security controls live on one Security page: the site-wide WAF toggle, JS Challenge bot protection, IP and country blocking, hotlink protection, request rate limiting, and link expiration. Every save deploys to the edge automatically — no separate publish step.
Write cache behavior with Add Rule
Configure domain/path cache key, TTL, methods/statuses, headers/cookies, optimization, and rate-limit rules.
Read WAF logs
Use WAF logs to explain blocked or challenged traffic without exposing internal log systems.
Purge cached content
Purge a path, saved path, or the whole account and separate CDN cache from browser cache.
Cache keys and purge: why "I purged but it's still old" happens
Every cached object is stored under a key built from the request — scheme, host, path, and query string. A purge only clears an entry when it addresses that exact key. Understanding this one idea explains nearly every "purge did not work" case.
Read cache status: HIT, MISS, BYPASS, EXPIRED
Use the X-Proxy-Cache-MT response header to see exactly what the CDN did with a request and to verify that caching works as intended.