Attack auto-escalation
When automatic defense sees an attack and traffic stays high, a site moves to high defense, unlimited defense or Cloudflare, then blackhole, and back.
What it solves
When attack traffic exceeds the nodes' uplink bandwidth, nothing a node does helps: the bandwidth is full before the traffic arrives. Attack auto-escalation does not handle individual requests; it moves the whole site to a line group that can take more:
| Level | Where the site goes |
|---|---|
| A Normal | The plan's line group the site uses day to day |
| B High defense | The plan's high-defense line group |
| C Unlimited defense | The plan's unlimited-defense line group; without one, your own bound and synced Cloudflare |
| D Blackhole | The domain resolves to 0.0.0.0 with a 60 s TTL and nodes drop what is left; the site owner is notified by in-app message, email or SMS on entering D |
Escalation needs both: automatic defense judged the site under attack within the last 2 minutes, and the site's combined request rate or response bandwidth across all nodes reached the next level's threshold for long enough. Heavy traffic that automatic defense has not judged an attack never escalates.
Turning it on
Attack auto-escalation is an official, free plugin of the commercial edition (io.cdnca.escalate) and relies on automatic defense's verdicts. The community edition does not include it: its policies live in plans, and the community edition has no plans.
- Administrators tag line groups as normal, high defense or unlimited under Line group tiers and grants, below the line group list.
- In the plan, pick the B line group (high defense only) and C line group (unlimited only) and set threshold ranges.
- Site owners turn escalation on or off in the site's Automatic defense tab and tune thresholds within the plan's range.
- The same tab shows the current level, the trigger, recent observations (30 s average) and the escalation log.
Main settings
| Setting | Set by | What it does |
|---|---|---|
| Line group tier | Administrator | Normal / high defense / unlimited; can be granted to resellers for their plans |
| A/B/C line groups | Plan owner | Site owners cannot change them; a level the plan leaves empty is skipped |
| Escalation thresholds | Site owner, within the plan | Request rate and bandwidth thresholds per level |
| Step-down | — | When every metric stays below a share of the threshold and the minimum stay has passed, step back one level |
| Lock / one-click reset | Administrator | Keep a site at a level, or return it to A |
| Last resort | Administrator | Set in the platform fallback chain: unlimited-defense line group or blackhole |
Typical uses
- You have a high-defense data centre: tag it high defense and make it level B, so sites move there under volumetric attack and come back afterwards.
- No unlimited-defense line: use your own Cloudflare for C, and go to blackhole only if that fails too.
- Reselling: grant your high-defense line group to a reseller so their plans can escalate to it.
Limits and notes
- It never decides whether traffic is an attack; without an automatic defense verdict it does nothing.
- Step-down goes D → C → B → A one level at a time, never straight to A.
- When several sites share a plan CNAME, the first escalation splits out a CNAME for the attacked site. If the domain is not on DNS hosted by this platform, the site owner changes it and clicks "I have changed it"; until then the site cannot change lines.
- If the stats window has not received every node's access logs yet, the level stays as it is, neither up nor down.
- The site is unreachable while blackholed.