Security protection

Enable baseline protection

DDoS scrubbing is enabled at the edge by default. Turn on managed WAF rules for public services, then tighten policies from observed traffic.

• Enable managed WAF rules
• Start high-risk rules in monitor mode
• Allowlist management entry IPs

Manage automated traffic

Observe bot-score distribution first, then challenge or rate-limit suspicious volume, frequency or invalid credentials.

Path: /login
Condition: bot_score < 30
Action: managed_challenge

Prepare incident response

Set an on-call contact and record peak traffic, critical paths and acceptable degradation options for faster decisions during an event.