Sites, domains, certificates and protection

For administrators: DNS and CNAME domains, adding sites, pointing domains, HTTPS certificates, protection and publishing.

For control-plane administrators: putting sites on the platform, pointing domains at it, HTTPS certificates and protection. Regular users managing their own sites should read the site user guide.

Before you start

• You are signed in to the admin console and have at least one initialised node in a line group (see install a node).
• A DNS provider and CNAME domain are set under "Nodes → DNS configuration" (see DNS and CNAME domains). Without them new sites get no CNAME.
• The site's owner has an active plan (see users, plans and resellers).
• You have the site's domain and origin address.

DNS and CNAME domains

This is set once for the whole control plane; site users do not repeat it.

1. Open "Nodes → DNS configuration". On the "DNS configuration" tab choose the provider (Alibaba Cloud, Huawei Cloud, DNSLA, DNSPod, 51dns, Cloudflare, Name.com and others), enter its credentials and save. Saved secrets are never shown again; leave them empty to keep them.
2. On the "CNAME domains" tab add the domain used to allocate site CNAMEs.
3. Reopen the page and check both are listed.

Never send DNS keys in screenshots or tickets. If saving fails, check the provider type, the key's permissions and that the domain belongs to that account.

Add a site

1. Open "Sites → Site list" and click "Add site". Use the "Single" tab first; use "Batch" once you are familiar with it.
2. Fill in the form:

1. HTTP listens on 80 by default and HTTPS is off; turn it on once the certificate is ready (see HTTPS). Click "Create site".
2. Search the list for the domain and check the "CNAME" column.

Once the CNAME has been written to the DNS provider and read back from it, the list shows the value with a copy button; while it is being written it shows "Generating" and the page refreshes by itself. You can update DNS as soon as the CNAME is shown; global propagation is up to the DNS provider and the platform does not wait for it.

If it shows "Generation failed", click it for the reason, for example that no default CNAME zone is configured. The dialog offers "Go to DNS configuration"; after fixing the cause click "Regenerate".

For batch adds, put one site per line as domain=www.cdnca.com,cdnca.com|ip=192.0.2.10, up to 100 lines. "Ignore errors" keeps going when one line fails. Check the success and failure counts afterwards; for entries marked "result pending", use "retry with the same request" rather than pasting again, so nothing is created twice.

Point the domain at the platform

1. Copy the site's CNAME from the site list.
2. Sign in to the DNS provider that manages the domain and add or edit a record.
3. Choose type CNAME. For www.cdnca.com the host is www and the value is the full CNAME you copied. Do not use the origin IP or another site's CNAME.
4. Save, wait for DNS to update, then open the site.

To confirm: the domain resolves to the platform CNAME and the site opens. Check HTTPS and the node publish result separately. If resolution is wrong, check the domain, host and conflicting records with the same name; wait for the TTL after a change.

A site's CNAME follows its plan and cannot be changed on the site. Change the CNAME domain under "Plans → Base plans"; when saved, the plan's sites regenerate their CNAMEs and the page shows progress and any skipped items with reasons.

HTTPS certificates

Prepare the certificate under "Sites → Certificates", then enable it on the site.

Request a certificate:

1. Make sure the domain already points at the platform.
2. On the "Automatic" tab of the certificates page click "Request certificate", enter the domains and choose HTTP-01 (file validation, the domain must point at the platform) or DNS-01 (choose a configured DNS API). Submit.
3. Watch the status move from validating and issuing to issued and active; check domains, auto-renewal and expiry. The failure column explains any failure.

Upload an existing certificate: on the "Certificate assets" tab click "Upload certificate", then "Activate version".

Enable it on the site:

1. Open "Sites → Site list", open the site and go to "HTTPS settings".
2. Turn on "HTTPS access" and check the HTTPS ports (for example 443). Turn on "Force HTTPS" if HTTP should redirect.
3. Under "Certificate" choose a valid certificate covering all the site's domains and click "Apply certificate". The page confirms the certificate is bound and the publish task is queued.
4. Open https://www.cdnca.com in a browser and check the certificate.

When a certificate is about to expire, check whether auto-renewal is on and whether renewal failed. Do not unbind a still-valid certificate first; fix renewal and confirm the new one is active. Never send private keys through public channels.

Edit a site

The site page has tabs: basic, origin, HTTPS, security, cache, CC protection, WAF protection, access control and advanced.

When changing origins, "Confirm" in the origin dialog only updates the draft on the page. Check the origin list, then click "Save changes" at the top of the page to submit. Reopen the site and check the address and publish result. If the page shows "result pending", click "Load latest configuration" to check before editing again.

Protection

• Turn site protection on and pick rules on the site's "CC protection", "WAF protection" and "Access control" tabs.
• Rules themselves live under "Sites": "CC rules", "WAF rules" and "Rule packs", along with smart auto-defence, the ban list and IP lists.
• After a change, check "Analytics → Block log", "WAF log" and "Block events" to see whether requests were handled as expected.

If legitimate requests are blocked, find the matching rule in the logs, change only that rule or add a narrow exception, and test again. Do not turn off all protection or allow broad networks.

Publishing and background tasks

Site, certificate and rule changes create publish tasks for the nodes. If a change does not take effect:

1. Open "System → Background tasks" and check the task's progress and result.
2. On failure, note the object and time, go back to its page for the latest state and act on the reason.
3. If unsure whether it worked, check the task and object first; do not submit the same change again.

Purge cache

"Sites → Purge and prewarm" refreshes URLs, directories or prewarms content. The steps are the same as for site users: see purge and prewarm. Administrators can also pick the target tenant.