Help Center/ Web Application Firewall/ FAQs/ Protection Rules/ Checking Block Events Generated by a CC Attack Protection Rule
Updated on 2026-10-10 GMT+08:00
View PDF
Share

Checking Block Events Generated by a CC Attack Protection Rule

  • To check whether a CC attack protection rule takes effect:
    • If the protective action of a CC attack protection rule is set to Block and the rule takes effect, the WAF block page is displayed when the rule is matched. The default response status code is 418.
    • If WAF logs are interconnected, you can query the CC attack protection rule ID in the attack logs to check whether any event is generated. By default, the status field of the corresponding event should be 418, and the action field should be block.
    • If WAF logs are interconnected, you can check the upstream_addr field in the access logs. If the value of upstream_addr is empty, the request is blocked before reaching the origin server.
  • Request logs may still be generated after a CC attack protection rule is triggered. This is normal in scenarios such as client retry, automatic crawler access, and CDN origin pull.
Parent topic: Protection Rules