What's New?

We have released RTLD Rate Limiting. Use this module to deliver log data that describes requests for which Web Application Firewall (WAF) enforced a rate limit as defined through a rate rule.

Rules Engine now has:

• Improved internationalization support for the following match conditions:

  URL Path Literal | URL Path Regex | URL Path Wildcard | URL Query Literal | URL Query Regex | URL Query Wildcard

• More flexible customer origin matching for the following features:

  Cache-Key Rewrite | URL Redirect | URL Rewrite

RTLD CDN now supports the following log fields:

Learn more.

A new POP location (i.e., MSP) in Minneapolis, Minnesota, USA is now live.

RTLD now supports the following log delivery destinations:

• Google Cloud Storage.
• New Relic (RTLD CDN only).

A new POP location (i.e., MTY) in Monterrey, Mexico is now live.

RTLD CDN now supports the ability to format log data using comma-separated values (CSV).

A new POP location (i.e., CHE) in Chicago, Illinois, USA is now live.

RTLD WAF now supports the ability to filter log data by Security Application Manager, Access Rule, Custom Rule, or Managed Rule configuration.

We have introduced a BETA version of bot rules for Web Application Firewall. Use bot rules to require a client to solve a browser challenge before honoring their requests.

Learn more.

Custom rules now also allows you to identify traffic by country, IP address, and the request URL path including query string.

Learn more.

A new POP location (i.e., VAP) in Santiago, Chile is now live.

A new POP location (i.e., WMI) in Warsaw, Poland is now live.

A new POP location (i.e., FRD) in Frankfurt, Germany is now live.

Web Application Firewall now supports custom rules. Custom rules allow you to define a profile or pattern through which WAF will identify threats. For example, you can create a custom rule that identifies requests by user agent.

Learn more.

Edge Image Optimizer now supports returning information about the source and output image.

Learn more.

A new POP location (i.e., SAC) in San Jose, California, USA is now live.

A new POP location (i.e., LAC) in Los Angeles, California, USA is now live.

A new POP location (i.e., SED) in Seattle, Washington, USA is now live.

We have released a new version of WAF. It expands upon all of the capabilities offered by WAF (legacy) and Rate Limiting (legacy) with a simplified and centralized setup that allows you to:

• Define the type of requests that will be secured.
• Reuse configurations when securing different applications.

Learn more.

A new POP location (i.e., PVR) in Guadalajara, Mexico is now live.

A new POP location (i.e., LHD) in London, UK is now live.

A new POP location (i.e., MBW) in Melbourne, Australia is now live.

Real-Time Log Delivery (RTLD) now consists of two modules:

• RTLD CDN encompasses the original behavior of RTLD. Use this module to deliver log data that describes requests submitted to our CDN service.
• RTLD WAF provides new functionality. Use this module to deliver log data that describes requests identified as threats by Web Application Firewall or Web Application Firewall (Legacy).

We have released Edge Image Optimizer. Use this feature to dynamically optimize your images at the edge of our network.

Our Certificate Provisioning System now supports automatic certificate renewal.

A new POP location (i.e., DMK) in Nonthaburi, Thailand is now live.

Our Certificate Provisioning System now supports requests for Extended Validation (EV) certificates.

A new POP location (i.e., MID) in Miami, Florida, USA is now live.

Real-Time Log Delivery now supports the ability to filter log data by user agent.

A new POP location (i.e., SOF) in Sofia, Bulgaria is now live.

Edge Performance Analytics now supports the ability to generate reports for 400 Bad Request, 401 Unauthorized, and 429 Too Many Requests status codes.

Real-Time Log Delivery now supports the ability to log custom request headers, response headers, and cookies.

Learn more.

Report Builder now allows you to generate reports that identify the request's TLS version (i.e., tls_version).

Learn more.

Real-Time Log Delivery now supports the following log fields:

• Background Fill Wait Time
• Client City
• Client Region

Learn more.

A new POP location (i.e., NWA) in Sydney, Australia is now live.

Real-Time Alerts now supports the ability to selectively apply alerts to specific edge CNAME configurations.

Learn more.

We have released the following features for Rules Engine - Advanced:

• Revalidate While Stale
• Revalidate While Stale Timer

These specialty features, which should not be confused with the Stale While Revalidate feature, determine how often our service will attempt to revalidate with your web servers when communication has been temporarily disabled due to repeated origin server availability issues.

We have released the Mask Client Subnet feature for Rules Engine - Basic. This feature masks a client's IP address for logging and reporting purposes.

A new POP location (i.e., KWI) in Salmiya, Kuwait is now live.

A new POP location (i.e., OTP) in Bucharest, Romania is now live.

We have added a new Rate Limiting dashboard that allows you to track whenever your requests are rate limited. This provides additional insight into the frequency at which your rate limiting thresholds are being exceeded.

Learn more (Web Application Firewall).

Learn more (WAF Essential).

A new POP location (i.e., MUC) in Munich, Germany is now live.

We now support the following HTTP variables:

• Path

  %{path}

  The Request URI variable (i.e., %{uri}) was deprecated in favor of the Path variable. Please update your configurations to use %{path} instead.

• Normalized Path

  %{normalized_path}

• Normalized Query String

  %{normalized_query}

• Normalized URI

  %{normalized_uri}

• QUIC Versions

  %{quic_altsvc_versions}

A new POP location (i.e., AMC) in Amsterdam, Netherlands is now live.

You may now self-service TLS certificates via our Certificate Provisioning System. Contact your CDN account manager to upgrade your account.

Learn more.

A new POP location (i.e., PIT) in Pittsburgh, Pennsylvania is now live.

A new POP location (i.e., WIL) in Nairobi, Kenya is now live.

A new POP location (i.e., BKK) in Bangkok, Thailand is now live.

Delivery setup now supports customer origin groups. A customer origin group configures a connection to either your web server(s) or an Azure block blob container.

If your account uses CDN storage, then you cannot upgrade your account to take advantage of our built-in support for Azure block blob storage. However, you may still upgrade your account to use customer origin groups.

Customer origin groups replaces the legacy method for configuring customer origins. Contact your CDN account manager if you would like to update your account.

Learn more about customer origin groups.

Learn more about Azure block blob storage.

A new POP location (i.e., LIS) in Lisbon, Portugal is now live.

Our implementation of QUIC now supports Google's latest format for specifying QUIC versions. If you have implemented QUIC via our QUIC feature, then no additional action is required on your part to leverage the latest QUIC versions.

Manually enabling QUIC via HTTP variables is not recommended. The recommended method for enabling QUIC is via the QUIC feature.

Our network now supports the WebSocket protocol. This protocol is useful for applications that require low latency or full-duplex communication.

Learn more (Customer Origin Group / Legacy).

Real-Time Log Delivery now supports the following log fields:

Learn more.

A new POP location (i.e., XIJ) in Kuwait City, Kuwait is now live.

Real-Time Log Delivery now supports the following log fields:

Learn more.

A new POP location (i.e., OSA) in Osaka, Japan is now live.

The following POP locations are now live:

• Atlanta, Georgia, USA (AGA)
• Dallas, Texas, USA (DAC)

Real-Time Log Delivery now supports:

• Multiple profiles.
• Formatting log data as a JSON array or lines when delivering to either web server(s), AWS S3, or an Azure Block Blob.
• Log data delivery to Datadog.
• Custom log data.

Due to the security risks inherent to FTP (e.g., authentication via cleartext passwords), access to CDN storage over FTP is undergoing end-of-life and will only be available until May 26, 2020.

If you are currently using FTP to view/manage CDN storage, please update your workflow to use SFTP or rsync.

Learn more.

Rules Engine now supports the ability to identify traffic through the following Device match conditions:

• Is App?
• Is Full Desktop?
• Is Robot?
• Is Touchscreen?
• Is Windows Phone?

Rules Engine now supports HTTP variables that provide the client's request protocol (i.e., %{virt_http_version}) and SSL/TLS connection information (i.e., %{virt_ssl_cipher} and %{virt_ssl_protocol}).

Stale responses now include a Warning response header.

A new POP location (i.e., LSV) in Las Vegas, Nevada, USA is now live.

A new POP location (i.e., NYD) in New York, New York, USA is now live.

A new POP location (i.e., CHD) in Chicago, Illinois, USA is now live.

We have released the Streaming Optimization feature for Rules Engine - Advanced. This feature automatically tunes your caching configuration to optimize performance for live streams and to reduce the load on the origin server.

A new POP location (i.e., BOG) in Bogota, Colombia is now live.

Report Builder has been released. This feature allows you to generate custom reports.

A new POP location (i.e., MNL) in Manila, Philippines is now live.

A new POP location (i.e., DCD) in Ashburn, Virginia, USA is now live.

Web Application Firewall and WAF Essential now supports accesslists through which you may identify traffic that may access your content upon passing inspection.

Learn more (Web Application Firewall).

Learn more (WAF Essential).

A new POP location (i.e., LHC) in London, UK is now live.

A new POP location (i.e., LPL) in Manchester, UK is now live.

Web Application Firewall and WAF Essential now enforces access control limitations across a category's allowlist and denylist.

Learn more (Web Application Firewall).

Learn more (WAF Essential).

Real-Time Log Delivery now supports the following log fields:

Learn more.

Rules Engine now supports HTTP variables (i.e., %{http_x_ec_uuid} and %{http_x_ec_session_id}) that track requests and sessions.

A new POP location (i.e., PAA) in Paris, France is now live.

Rules Engine now supports the ability to identify traffic through the following Location match conditions:

• City Name Literal
• City Name Regex
• Continent
• DMA Code
• Latitude
• Longitude
• Metro Code
• Postal Code
• Region Code

A new POP location (i.e., PHX) in Phoenix, Arizona, USA is now live.

WAF Essential has been released. WAF Essential provides limited Web Application Firewall and Rate Limiting functionality. Specifically, it is limited to 2 profiles, 1 instance, and 3 rate limiting rules.

Learn more.

A new POP location (i.e., CMC) in Chicago, Illinois, USA is now live.

A new POP location (i.e., MDR) in Madrid, Spain is now live.

The maximum file size for edge server compression has been increased to 3 MB.

Real-Time Log Delivery now supports:

• Log delivery to Azure Blob Storage.
• Filtering log data by HTTP status code and/or edge CNAMEs.

A new POP location (i.e., MIL) in Milan, Italy is now live.

Rate Limiting has been updated to perform case-sensitive exact matches under the following conditions:

• All match conditions.
• Hostname and URL path matches when the "Exact match (multiple entries)" mode has been selected.

Learn more.

WAF now supports the capability to define rule exceptions. The purpose of rule exceptions is to reduce false positivesWeb Application Firewall: A false positive is a legitimate request that was identified as malicioius traffic by Web Application Firewall..

Learn more.

The following POP locations are now live:

• Philadelphia, Pennsylvania, USA (PHD)
• Detroit, Michigan, USA (DTW)

A new Rules Engine feature (i.e., QUIC) and an HTTP variable (i.e., %{quic_versions}) have been introduced to make it easier to set up QUIC support.

Learn more about QUIC.

A new POP location (i.e., TPE) in Taipei, Taiwan is now live.

A new POP location (i.e., GDL) in Guadalajara, Mexico is now live.

A new POP location (i.e., DNA) in Denver, Colorado, USA is now live.

Real-Time Log Delivery now supports the ability to push log data to Splunk Enterprise and Sumo Logic.

User privileges are now enforced on REST API requests. Please ensure that the user associated with your REST API token has been granted sufficient permissions to perform the equivalent action within the MCC.

A new POP location (i.e., SKA) in Stockholm, Sweden is now live.

We have introduced a BETA version of the Report Builder. This feature allows you to download customized report data.

Learn more.

A new POP location (i.e., SGC) in Singapore is now live.

A new POP location (i.e., VIA) in Vienna, Austria is now live.

A new POP location (i.e., SPB) in São Paulo, Brazil is now live.

A new POP location (i.e., BSA) in Boston, Massachusetts, USA is now live.

Rate Limiting configuration now has a new look and feel. Additionally, the procedure for configuring Rate Limiting rules is slightly different.

View configuration information.

A new Edge Performance Analytics report for the 503 Service Unavailable response code is now available.

Learn more.

A new POP location (i.e., SYA) in Sydney, Australia is now live.

Log data may now be delivered to AWS S3 or your web server(s) in near real-time by leveraging Real-Time Log Delivery.

Learn more.

Due to the security risks inherent to FTP (e.g., authentication via cleartext passwords), log delivery to your web server over FTP is undergoing end-of-life and will only be available until September 19, 2018.

If you are currently using FTP for log delivery, please update your log delivery configuration to use SFTP immediately.

Learn more.

A rate limiting policy now applies to all CDN traffic. Requests to each delivery platform are counted separately.

Learn more.

Rules Engine now supports the capability to define the variables that are passed to bespoke traffic processing logic.

Learn more.

The following POP locations are now live:

• Paris, France (PAB)
• Rio de Janeiro, Brazil (RIB)
• Singapore (SGB)

A new POP location (i.e., AMB) in Amsterdam, Europe is now live.

A scope may now be applied to a Rate Limiting rule.

Learn more.

Rules Engine now supports the capability to rename HTTP Progressive Download's video seeking parameters through the H.264 Support Video Seek Params feature.

Edge Optimizer has been deprecated and should not be applied to your traffic. This feature is scheduled to undergo end-of-life in the near future.

A new POP location (i.e., BLR) in Bangalore, India is now live.

A new POP location (i.e., TIR) in Chennai, India is now live.

A new POP location (i.e., NDL) in Delhi, India is now live.

A new POP location (i.e., MRS) in Marseille, France is now live.

Classes of status codes (i.e., 2xx, 3xx, 4xx, and 5xx) will no longer exclude status codes that are individually tracked (e.g., 403 and 404 for 4xx reporting). This change was applied to the following reports:

• Real-Time Statistics: Detailed Real-Time Statistics

• Real-Time Statistics: Real-Time Alerts

  The number of requests reported for each class of status code may increase as a result of this change. Please adjust your alert configurations accordingly.

• Edge Performance Analytics: 4xx Errors Report
• Edge Performance Analytics: 5xx Errors Report

Requests may now be rate limited according to HTTP method (e.g., GET, POST, PUT, etc.).

Learn more.

We have introduced a beta version of the Edgecast Rule Set (ECRS). This rule set is primarily based off of OWASP CRS 3.0.x rules and provides generic protection against a variety of unknown vulnerabilities.

Learn more.

We have introduced the following design changes to make it easier to get started with Web Application Firewall:

• There is a new landing page (WAF Quick Start) through which you may quickly define a new WAF configuration.

  Learn more.

  The WAF Quick Start page has replaced the Welcome page. This page allows you to quickly set up a profile and an instance.

  Set up WAF via this page by performing the following steps:

  1. From the Profile option, create or select an existing profile.

     Create a profile by selecting "New Profile" from the Profile option and then typing the name that will be assigned to it. By default, profiles created through this page will be assigned a recommended configuration. Fine-tune this configuration by clicking the Profile Advanced Settings link.

  2. From the Instance option, define the name that will be assigned to a new instance.

     This instance will be configured to use the profile and action type defined on this landing page.

  3. From the the Action option, select the type of action that will take place when a threat is detected.

  4. Upon saving the above configuration, activate the instance defined in step 2 via Rules Engine.

     Learn more.

• The design of the Profile Manager and Instance Manager pages have been streamlined in the following ways:

  • The option to view a profile or instance in read-only mode has been removed.
  • View and/or modify a profile or instance by clicking on it.
  • The option to delete a profile or instance has been moved. Delete a profile or instance by clicking on it and then clicking either the Delete Profile or the Delete Instance link.

• A new design and layout have been applied to profile configuration to make it easier to focus on relevant settings. Additionally, profiles now support additional threat screening capabilities.

  Learn more.

  Instead of setting up a profile via a single page, settings have been sorted into the following three categories:

  • Settings: This tab contains basic profile settings.

    • In addition to moving the Ignore cookies by name onto this tab, we have added the ability to ignore specific headers and query string arguments when analyzing a request.
    • Expand the More Details section by clicking on it to view query string and file size global settings.
  • Access Controls: This tab contains allowlists and denylists for user agents, URLs, and referrers. Additionally, we have the added the capability to define a allowlist and/or denylist by country. Finally, expand the Basic Settings section by clicking on it to view global settings that define the set of allowed HTTP methods, allowed media types (aka content types), and disallowed file extensions.
  • Policies: This tab associates a rule set with the profile and defines the polices and rules that will be used to assess whether a request is malicious.

  The Allowed HTTP Versions option has been removed.

Platform-specific real-time statistics may now be filtered by edge CNAME, POP, or country.

Learn more.

A new POP location (i.e., HKC) in Hong Kong is now live.

A new POP location (i.e., MEX) in Mexico City, Mexico is now live.

The IAD POP location has been deprecated.

A new POP location (i.e., JNB) in Johannesburg, South Africa is now live.

A new POP location (i.e., MIC) in Miami, Florida, USA is now live.

The "Apply Global Rate" value has been renamed to "Any Request."

The embedded FTP client (i.e., File Manager) has been deprecated. Please considering using one of the following alternative solutions:

• SFTP
• rsync
• Third-party FTP client

A new POP location (i.e., PBC) in Puebla, Mexico is now live.

The amount of time that a client will be rate limited may now be configured via the Enforce action for client exceeding rate limit for option when setting up a rule.

Learn more.

A new POP location (i.e., SAA) in San Jose, California, USA is now live.

The following items have been deprecated:

• Signature threat detection mode

  The only supported threat detection mode is anomaly scoring.

  All WAF profiles that were configured to use signature mode were automatically converted to use the equivalent anomaly scoring configuration. This conversion process did not affect how threats are detected on your traffic.

• Trustwave CRS as a standalone rule set

  The Trustwave CRS is included in our Trustwave-OWASPIntegration-Application rule set.

• Outdated rule sets

As a part of this change, the syntax used to identify rule sets has changed to include the date on which the rule set was introduced.

Learn more.

A new POP location (i.e., RIX) in Riga, Latvia is now live.

A new POP location (i.e., SEC) in Seattle, Washington, USA is now live.

The following changes have been applied to Rate Limiting:

• The capability to rate limit requests on a per hour basis has been eliminated.

  Preexisting hourly configurations have been migrated to rate limit requests based off of 5 minute intervals.

• Requests may now be rate limited according to the following time intervals:

  1, 5, 10, 30, 60 (1 minute), 120 (2 minutes), or 300 (5 minutes) seconds.

• Rate Limiting will now only be enforced on a per edge server basis. In other words, each edge server will individually track requests to determine whether they should be rate limited.

Dynamic Cloud Packaging now supports the ability to rotate encryption keys via the Encrypted Key Rotation feature.

The Encrypted Key Rotation feature requires activation. Please contact your CDN account manager for more information.

Learn more.

A new POP location (i.e., NAG) in Mumbai, India is now live.

The following changes have been introduced to the dashboard:

• A Performance section that contains a high-level overview of CDN performance and usage has been added to the dashboard.

  The Performance section contains updated terminology that provides increased accuracy for traffic identification. Additionally, it now provides statistics on two new cache status codes (i.e., Not Cached and Expired). Finally, friendlier names have been applied to existing cache status codes.
  Learn more.

• A Usage section has been added directly below the Performance section. This section contains reports that track bandwidth usage (Avg. Usage/Sec) and the amount of data that was transferred via the CDN for your account.
• The Bandwidth report has been renamed to Avg. Usage/Sec.

Learn more.

A new POP location (i.e., AGA) in Atlanta, Georgia, USA is now live.

The main landing page is now known as the dashboard. As a result of this change, the Home menu item and privilege has been renamed to "Dashboard."

A bucket's contents may now be deleted 100 assets at a time.

Learn more.

The Flash Media StreamingThis service was discontinued on 5/31/2017. The Flash Media Streaming platform streamed live and on-demand content via a Flash media player over a RTMP-based protocol., HLSThis feature generates and delivers custom reports., and HDS services are now discontinued.

Please take advantage of our Dynamic Cloud Packaging to continue streaming a RTMP feed. Alternatively, consider using Media Ingest for end-to-end HTTP streaming.

User administration has been redesigned. As a result, the following changes were made:

• User configuration is now split into two tabs. There is a tab for user settings (i.e., User Info) and another one for defining API access and privileges (i.e., Permissions).
• The capability to delete a user and various user settings have been moved to a More Details section within the User Info tab. Delete the current user or view/configure those settings by expanding that section.
• The Grant API Access Token option has been removed. A user's API permissions now determine whether that user will be granted a Web Services REST API token. A user must be granted access to at least one HTTP method (e.g., GET or POST) in order to receive a token.
• The PUT/POST API permission has been split into two separate permissions (i.e., PUT and POST).
• By default, the GET method is marked when creating a new user.

• An account-wide two-factor authentication may no longer be defined. Two-factor authentication may now only be configured on a per user basis. By default, the Two-Factor Authentication option is turned on for new users.

  If two-factor authentication was previously disabled across the entire customer account, then it currently cannot be enabled on a per user basis. Existing customer accounts will be migrated soon to take advantage of this capability.

• An administrator may no longer reset a user's password when clearing a 2FA configuration.
• The Password Expiration label has been renamed to Password Reset Duration. Additionally, it may now only be set to never expire or a preset time interval (i.e., 30, 90, or 120 days).

The HTTP/2 protocol is now supported for client to edge communication over HTTPS.

Learn more.

Our online help has been redesigned to accommodate smaller screens. By default, the table of contents and the search bar will be hidden on smaller screens.

To show/hide the table of contents and the search bar

• Press the icon to show the table of contents and the search bar.
• Press the to hide the table of contents and the search bar.

Our online help has been redesigned and simplified in order to provide a streamlined experience.

Are you looking for our glossary? If so, view a glossary of terms by expanding More Information and then clicking Glossary.

Our online help is fully searchable. Search our online help by keyword(s) or phrase to find relevant information.

The content in the help center has been reorganized into the following categories:

• Content Delivery: This section contains information on the delivery of content over HTTP/HTTPS, such as origin server setup, cache management, and Rules Engine. Additionally, this section now contains relevant tutorials, FAQs, and troubleshooting information. Finally, related articles have been consolidated into a single article. For example, there used to be three articles describing customer origin server compression. The information in those articles have been consolidated into a single article.
• Security: This section describes various CDN security features, such as HTTPS, Country Filtering, and Token-Based Authentication. Additionally, this section now contains relevant tutorials and FAQs.
• Streaming: This section describes our various streaming solutions. Additionally, this section now contains relevant tutorials, FAQs, and troubleshooting information.
• Reports: This section describes our various reporting modules.
• Route (DNS): This section describes our DNS service.
• More Information: This section contain miscellaneous information, such as basic MCC usage, user account administration, and reference material.