Got a Docker Compose file? Your project goes live in seconds — one command on cdn.com.tr. See how Built your app with AI? From folder to live URL with one command — no git, no registry: cdnctl deploy. See how Code on GitHub? Every push auto-deploys to cdn.com.tr — connect your repo and ship. See how

CDN.com.tr Help

Read WAF logs

Use WAF logs to explain blocked or challenged traffic without exposing internal log systems.

Cache, security, WAF, and purge

Read WAF logs

Use WAF logs to explain blocked or challenged traffic without exposing internal log systems.

Panel path

  1. Management Panel
  2. CDN Accounts
  3. Advanced Management WAF
  4. WAF Logs
  5. WAF exceptions

Prerequisites

  • WAF log query must be limited by selected account and time range.
  • IP, domain, and request details are treated as data fields in screenshots.
  • If no log is found, filter/range checks are shown to the user.

Step-by-step guide

1

Filter WAF logs

Blocked/challenged traffic is explained from customer-facing screens without internal log-system access.

  • Open WAF Logs.
  • Choose a time range, or paste the Reference ID from the block page and press Enter (searches the last 30 days).

Expected result: Only selected-account security events are listed.

cdnctl equivalent 
cdnctl waf logs --account $ACCOUNT_UUID --range 1d
cdnctl waf show $REFERENCE_ID --account $ACCOUNT_UUID
2

Choose the action

For a false positive, exempt that rule on that path; for real attack traffic, keep the WAF on.

  • Read action and rule name.
  • If the rule is the HTTP method check, add the method under Allowed HTTP methods on the same page.
  • For a false positive, press Exempt next to the rule, check the path and field under WAF exceptions and press Add exception; the edges apply it within 1-2 minutes. Export the report (CSV/XLSX) if you need the full list.

Expected result: The customer safely understands why a request was blocked.

cdnctl equivalent 
cdnctl waf logs --account $ACCOUNT_UUID --range 1d --format json
# The rule name and client IP are what decide whether a block was correct.

Verification

  • Log response does not include another account event.
  • IP/path data is redacted in docs.
  • Internal log host or service name does not appear in customer guides.

Use cases

A customer reports a request that is blocked by security rules.

Quick workflow

  1. Open WAF logs.
  2. Choose a time range, or look up the Reference ID from the block page.
  3. Inspect action and rule.
  4. For a legitimate request, press Exempt next to the rule to add a WAF exception for that path (and field).

Checks

  • Selected account has a WAF route.
  • Log query does not leak another account.
  • Support guidance includes timestamp and request details.

Related pages

The Security page: WAF, IP and country blocking, hotlink, rate limit

All account-level security controls live on one Security page: the site-wide WAF toggle, JS Challenge bot protection, IP and country blocking, hotlink protection, request rate limiting, and link expiration. Every save deploys to the edge automatically — no separate publish step.

Block traffic by ASN and by country

Two account-wide blacklists on the same panel: block whole countries by country code, or block whole networks by autonomous system number. A blocked visitor gets the branded 403 page with a Reference ID.

Turn on HSTS for your hostnames

The Hsts security preset makes the edge send Strict-Transport-Security: max-age=31536000 on HTTPS responses, so a browser that has seen your site once refuses to open it over plain HTTP for a year.

Purge cached content

Purge a path, saved path, or the whole account and separate CDN cache from browser cache.

Signed URLs: links that expire

Protect a file so it can only be fetched with a signature you generate, valid until a moment you choose. Unsigned requests get 403, expired ones get 410.

Image optimization: AVIF and WebP at the edge

Switch on image optimization for the account or for one delivery rule and choose WebP or WebP + AVIF: the edge converts JPEG and PNG images and sends each browser a format it accepts, while your pages keep the same image URLs.