Bot protection (JS Challenge)
The challenge modes on this same page: how risky visitors are picked and verified.
Open the topicCDN.com.tr Help
The Security page: WAF, IP and country blocking, hotlink, rate limit
All account-level security controls live on one Security page: the site-wide WAF toggle, JS Challenge bot protection, IP and country blocking, hotlink protection, request rate limiting, and link expiration. Every save deploys to the edge automatically — no separate publish step.
Cache, security, WAF, and purge
The Security page: WAF, IP and country blocking, hotlink, rate limit
All account-level security controls live on one Security page: the site-wide WAF toggle, JS Challenge bot protection, IP and country blocking, hotlink protection, request rate limiting, and link expiration. Every save deploys to the edge automatically — no separate publish step.
Panel path
- Management Panel
- CDN Accounts
- Security
Prerequisites
- The account must be selected on the page; all controls apply per account.
- For country blocking, use ISO 3166-1 alpha-2 codes.
Use cases
You want to block an abusive IP range, stop another site from embedding your images, or put a rate limit in front of a scraper — without hunting through Delivery Rules for the right hidden section.
Workflow
- Open the Security page and confirm the right account is selected — every control on the page applies to that account.
- Make one change at a time: add the IPs (one per line), the ISO country codes, the hotlink domains, or the rate limit numbers, and press that control's own Save.
- Wait for the inline confirmation. Each save pushes a new edge configuration for the account automatically.
- Verify from outside: a blocked IP or country gets an error response, a foreign-referer image request is refused, and requests beyond the rate limit are rejected until the window resets.
Checks
- WAF toggle is site-wide for the account: it inspects request content (SQL injection, XSS patterns). JS Challenge is separate — it verifies that the client is a real browser, in risk-based or all-traffic mode.
- IP blocking takes one address per line. Country blocking takes two-letter ISO codes (TR, DE, US) — it blocks visitors, so double-check the code before saving.
- Hotlink protection is whitelist OR blacklist: whitelist means "only these sites may embed my files", blacklist means "everyone except these". List your own domains (including www) in a whitelist.
- Rate limit is N requests per M seconds per client. Set it from real traffic: a human browses in bursts; a scraper sustains. Too tight a limit hits real users first.
- These same settings are also visible inside Delivery Rules — it is the same data, one place to manage it. Changing it here changes it there.
Frequently asked questions
I blocked a country but a visitor from there still gets through.
Country lookup is by the connecting IP's GeoIP record. VPNs, proxies, and roaming SIMs resolve to where the IP is registered, not where the person sits. Country blocking raises the fence; it is not a guarantee of origin.
Will hotlink protection break my own site or newsletter images?
Not if the list is right: in whitelist mode include every domain of yours that embeds the files (www and subdomains). Email clients often send no referer at all — test one campaign after enabling. The help topic on cache status headers shows how to test with curl.
What is a sensible first rate limit?
Look at what a heavy real user does on your busiest page and leave generous headroom above it. Start loose, watch the WAF/attack dashboards on the same page, then tighten. A limit you never trip is still useful — it caps the worst case.
Do I need to deploy or purge after saving?
No. Every save on this page queues an edge configuration deploy for the account automatically. Purge is for cached content, not for security settings — they take effect on new requests.