Automatic defense
Nodes learn normal traffic per site and, on attack, challenge, rate-limit, ban and kernel-block step by step, then withdraw. Learning free, mitigation paid.
What it solves
New attack variants keep coming, hand-written rules are always a step behind, and nobody can watch the logs all day. Automatic defense learns a normal-traffic baseline for every site on every node, judges a site "under attack" when traffic turns anomalous and says why (which feature, current value, baseline, deviation), mines the attack traffic for rule features and mitigates step by step. Learning, judging and mitigating all happen on the node, without waiting for the control plane.
| Level | Action |
|---|---|
| L0 | Observe, log only |
| L1 | Challenge (invisible JS, 5-second shield, PoW) |
| L2 | Rate limit |
| L3 | Temporary ban |
| L4 | Kernel ban (nftables) |
| L5 | XDP (reserved, currently runs as L4) |
Turning it on
| Plugin | What it covers | Price |
|---|---|---|
Automatic defense (io.cdnca.autodefense) | Baselines, observing and judging, attack alerts, suggested rules, suggestion-only mode | Official and free, in the commercial default licence |
Automatic defense: automatic mitigation (io.cdnca.autodefense-auto) | Automatic mitigation; "smart auto" in each protection module | Official and paid, bought in the plugin market |
With only the free part, pages show verdicts and suggestions but nothing is mitigated, and Start protection and each module's smart auto are marked "purchase required".
- Under Sites → Automatic defense, or the Automatic defense tab of a site, click Start learning (new sites start off).
- Recommended order: learning (at least 1 day) → observe only (at least 7 days, until verdicts look right) → automatic protection (needs automatic mitigation).
- Recent verdicts and Automatic rules show the reasons and the generated rules.
Main settings
| Setting | What it does |
|---|---|
| Site mode | Off / learning / observe only / automatic protection |
| Highest action | Automatic by default; set a manual ceiling until you click Restore automatic |
| Smart auto per module | CC, bots, WAF, scanners and credential stuffing, L4 port groups: manual / smart auto / suggestions only; any value you change becomes manual and is left alone |
| Bounds | Only narrow the range automatic tuning may use |
| Automatic rules | Keep as my own WAF or CC rule, or disable the signature |
| Cross-site defense within a tenant | An IP temporarily banned on 2 or more of your sites is rate-limited on your other opted-in sites (off by default) |
Typical uses
- A new site goes live: learn for a day, observe for a week, then turn on automatic protection once the verdicts look right.
- Legitimate traffic hit: Release all on the site undoes every automatic action, or release one entry in the block log, add it to the allowlist and mark it a false positive.
- An attack that fills the nodes' uplink: combine with attack auto-escalation to move the whole site to a high-defense line group.
Limits and notes
- Automatic defense never changes line groups and cannot absorb volumetric attacks beyond the nodes' uplink; use attack auto-escalation for those.
- Never mitigated: verified search engine crawlers, the site allowlist, your own allow rules, platform nodes and probe networks.
- Too many false positives, nearly the whole site mitigated or failed rule delivery trip a circuit breaker for that site, which then runs on your own CC/WAF/DDoS settings; it recovers after 30 minutes, and a second trip within 24 hours needs an administrator.
- With an immature baseline only challenges and rate limits are allowed, no temporary bans.
- Only dynamic-routing nodes run automatic defense.
- The community edition does not include automatic defense; it has CC auto switch (a stricter rule group during traffic spikes) and WAF automatic banning only.