Automatic fallback chain
When nodes fail or are overwhelmed, a site steps down own nodes → backup line group → subscribed nodes → third-party CDN, and steps back once they recover.
What it solves
When your own nodes fail, a site stays down until someone changes DNS by hand, often in the middle of the night. The fallback chain lines up everything a site can run on and moves to the next level automatically when the current one is unavailable, stepping back level by level once it recovers:
- Own nodes: the line group the site currently uses (including high-defense or unlimited-defense groups set by attack auto-escalation).
- Backup line group: the backup line group set in the plan.
- Supplier nodes: nodes this control plane subscribed to on the node market.
- Third-party CDN: carried by the control plane operator's own third-party CDN accounts, never another tenant's.
A level without resources is skipped. The blackhole is not part of the chain; only attack auto-escalation uses it, and only during an attack.
| Feature | When it acts | What it does |
|---|---|---|
| Fallback chain | The current level is unavailable | Moves the whole site's DNS to the next level |
| Attack auto-escalation | Automatic defense sees an attack and traffic exceeds the threshold | Moves to the plan's high-defense and unlimited groups, finally a blackhole |
| Automatic defense | Attack requests reach a node | Challenges, rate-limits and bans requests without touching DNS |
When an attack is too big even for the high-defense and unlimited groups, the fallback chain carries on to supplier nodes or a third-party CDN.
Turning it on
The fallback chain is on by default in the commercial control plane, and new sites use the platform default. The first two levels (own nodes, backup line group) come with the control plane; the last two (supplier nodes, third-party CDN) need the aggregated edge module (official and free in the commercial edition) and sit out while it is not licensed. The community edition does not include the fallback chain.
- Administrators set the platform-wide default (on or off, order, last resort under attack) in System settings → Other or Automatic defense → Platform; the card saves on its own.
- Each site can override it under Site edit → Automatic defense: follow the default, turn it off, or set its own order and exclude levels.
- The same tab shows each level's state (available, unavailable, checking, not configured), the current level and the switch history.
Main settings
| Setting | Default | What it does |
|---|---|---|
| Fallback chain on | On | When off, sites no longer move along the chain |
| Default order | Own nodes → backup group → supplier nodes → third-party CDN | Reorder as needed |
| Last resort (under attack only) | Unlimited-defense line group | Or blackhole; falls back to blackhole when no unlimited group is set |
| This site | Follow the default | Off, custom order, exclude levels |
| Lock at this level | — | Stops automatic switching until one-click failback |
| One-click failback | — | Clears a lock or freeze and moves to the first available level |
Typical uses
- A small platform without a second data centre: subscribe to one supplier as level three; when your nodes fail the site moves there and comes back automatically.
- You already have a Cloudflare account: use it as the last level so the site stays up when everything before it is down.
- Before maintaining a line group: lock the affected sites on the backup group, then fail back in one click afterwards.
Limits and notes
- Too many switches within an hour freeze automatic switching and notify administrators.
- A site on a CNAME shared by its plan gets its own CNAME the first time it needs to switch. If the domain is on a verified DNS account on this platform, DNS is updated automatically; otherwise the site owner is told to change it, and the chain does not switch that site until it is changed.
- A site without a CNAME yet cannot be switched.
- Sites without a valid plan are not carried by the operator's third-party CDN.
- Site owners can keep their own third-party CDN out of the chain.