Reference
How nodes and the control plane actually behave: decision rules, defaults, response headers and cookies, and what happens on failure. Every number comes from the current code.
What nodes add to requests and responsesHeaders nodes send to origins, response headers and cookies visitors get, and paths nodes answer themselves: for origin developers and scanners.Cache: status headers, bypass reasons, purgesHow node caching decides: X-CDN-Cache values, the 15 bypass reasons and fixes, the cache key, and how purges and prewarm take effect.Certificates: failures, renewal, handshakesCertificate order states, failure types and fixes, which failures retry, when renewal starts, and how nodes pick a certificate during the TLS handshake.CC protection: counting and statisticsHow nodes count for CC rules: fixed window and leaky bucket, per-node and per-tenant counters, failure behaviour, and what the statistics page counts.Origins: levels and health checksHow origin levels are judged healthy, who probes, how many failures switch, what happens when all are down, failback modes, and node retries.Automatic defense: how it worksAutomatic defense levels, verdict and step-down timing, how automatic rules advance and stand by, what is never mitigated, circuit breaking and federation.L4 forwarding: client IP to the originThe three ways L4 forwarding passes the client IP to the origin, the TOA option format and limits, installing a TOA receiver, and how to verify it.Server-Timing headerThe Server-Timing response header: cache status, the cache layer that answered, and origin connect and first-byte times, visible in browser developer tools.Lists and objects: string setsLists and objects: keep paths, user agents and hostnames shared by many rules in one string set, change it once, and every WAF rule that uses it follows.Browser, device and time conditionsNew rule conditions: browser, browser version, device type and request time window. Allow by user agent, route by device, or apply a rule only at set hours.Token validation (JWT)Token validation: verify the JWT in a request on the node with your identity provider keys, then allow or block by the claims in the token.URL authenticationURL authentication: add an expiry time and signature to download or playback links; the node returns content only when the signature checks out.Status pageStatus page: a public page showing component status, uptime, incidents and maintenance notices to your customers, plus a platform status JSON.DoH serviceDoH service: nodes answer DNS queries for your platform site domains over HTTPS (RFC 8484). Hostname, node range, scope, rate limit, auth and upstream settings.Real user experienceReal user experience: measure load, interaction and stability in visitors browsers, count resource and request errors, and read p75 ratings in the console.Content rewritingContent rewriting: rewrite the HTML, CSS and JavaScript returned to visitors on the node. Link rewriting, text replacement and forced HTTPS, with a rule tester.Edge scriptsEdge scripts: Lua on the node for custom authentication and redirects, run from a WAF rule action. How to enable, available APIs and failure policy.Human verification and challengesHuman verification and challenges: the built-in modes, what a pass is bound to, and settings for Tencent Captcha, GeeTest, Turnstile and reCAPTCHA v3.IPv6 supportIPv6 support: how websites, L4 forwarding, origin addresses, kernel bans and TOA handle IPv6, and how to read a website IPv6 runtime state.Website articlesWebsite articles: write and publish articles in the console; they show in the article list and home page news, with featured, scheduling and covers.What changed in 1.0.35What 1.0.35 adds, improves and fixes, plus behavior changes to sign-up and password recovery, the home page expiry, error messages and node package updates.Node reinstall guideNode reinstall guide: generate the command in the console, purge the old state, install again; configuration and certificates are then redelivered.