Help Center/ Web Application Firewall/ User Guide/ Connecting Your Website to WAF/ Recommended Configurations After Website Connection/ Enabling Break Protection to Protect Origin Servers
Updated on 2025-12-12 GMT+08:00
View PDF
Share

Enabling Break Protection to Protect Origin Servers

If there are too many 502 Bad Gateway, 504 Gateway Timeout, or delayed responses after your website is connected to WAF, WAF enables break protection to protect your website.

Principles

Break Protection, you need to configure Breakdown Protection and Connection Protection for it.
  • Breakdown Protection: detects abnormal response codes. If your website experiences excessive 502 Bad Gateway or 504 Gateway Timeout errors after being connected to WAF, WAF breakdown protection will stop forwarding user requests. This protects your website from potential further damage.
  • Connection Protection: detects TCP connection delay. If your website experiences excessive request processing delays after being connected to WAF, WAF connection protection will stop forwarding user requests. This protects your website from potential further damage.
Cloud WAF and dedicated WAF modes support break protection.
  • Cloud mode: This function is enabled by default and cannot be disabled. The default value is as shown in Table 1 and cannot be changed.
  • Dedicated mode: You can enable or disable this function and configure the interruption threshold and protection time based on your service requirements. For details, see Enabling Break Protection.
Table 1 Principles

Function

Trigger Condition

Default Value

Breakdown Protection

When the number of 502/504 errors reaches the 502/504 Error Threshold (the number of 502/504 errors returned every 30 seconds) and the percentage of 502/504 errors reaches the 502/504 Error Percentage (%) (the percentage of 502/504 errors in the total number of requests), WAF automatically triggers the breakdown protection for the website within the Initial Downtime (s). WAF then stops forwarding user requests to relieve the access pressure caused by a large number of 502/504 errors.

If the breakdown protection is triggered continuously within one hour, WAF prolongs the downtime protection time based on the configured Multiplier for Consecutive Breakdowns. For example, assume that you set the initial downtime to 180s and the maximum multiplier to 3. If breakdown protection is triggered a second time, the website downtime is 360s (180s x 2). If the breakdown protection is triggered a third or fourth time, the website downtime is 540s (180s x 3). The breakdowns are counted from 0 when the total breakdown duration exceeds one hour.
  • 502/504 Error Threshold: 6,000
  • 502/504 Error Percentage (%): 99%
  • Initial Downtime (s): 15s
  • Multiplier for Consecutive Breakdowns: 2

Connection Protection

When the number of requests waiting for responses reaches the value of Pending URL Request Threshold, WAF automatically triggers the connection protection and protects the website within the period specified by Duration (s). WAF stops forwarding user requests during this period to relieve the pressure caused by a large number of requests.
  • Pending URL Request Threshold: 8,000
  • Duration (s): 10s

Constraints

Function

Constraint

Mode
  • Cloud mode: Break protection is supported, but it cannot be disabled, and the threshold and protection duration cannot be modified.
  • Exclusive mode: You can manually enable or disable this function, and change the threshold and protection duration.

    Before enabling this function, make sure you have upgraded dedicated WAF instances to the latest version, or your services might be affected.

Region constraints

You can check the console to see whether this function is supported in a specific region.

Prerequisites

Enabling Break Protection

  1. Log in to the WAF console.
  2. Click in the upper left corner and select a region or project.
  3. (Optional) If you have enabled the enterprise project function, in the upper part of the navigation pane on the left, select your enterprise project from the Filter by enterprise project drop-down list. Then, WAF will display the related security data in the enterprise project on the page.
  4. In the navigation pane on the left, click Website Settings.
  5. On the Website Settings page, click the target website domain name.
  6. In the Break Protection area, click the status icon to toggle it on.

    Figure 1 Break Protection

  7. Click next to each parameter, edit Breakdown Protection and Connection Protection parameters to meet your requirements, and click OK to save settings. Table 2 describes these parameters.

    Table 2 Parameter description

    Parameter

    Description

    Example Value

    Breakdown Protection

    502/504 Error Threshold

    30s 502/504 Error Threshold

    1,000

    502/504 Error Percentage (%)

    A breakdown is triggered when the 502/504 error threshold and percentage threshold have been reached.

    90

    Initial Downtime (s)

    Protection period upon the first breakdown. During this period, WAF stops forwarding client requests.

    180

    Multiplier for Consecutive Breakdowns

    The maximum multiplier you can use for consecutive breakdowns. The number of breakdowns is counted from 0 every time the accumulated breakdown protection duration reaches 3,600s.

    For example, assume that Initial Downtime (s) is set to 180s and Multiplier for Consecutive Breakdowns is set to 3.
    • If the breakdown is triggered for the second time, that is, less than 3, the protection duration is 360s (180s x 2).
    • If the breakdown is triggered for the third or fourth time, that is, greater than or equal to 3, the protection duration is 540s (180s x 3).
    • The breakdowns are counted from 0 when the total downtime duration exceeds one hour (3,600s).

    3

    Connection Protection

    Pending URL Request Threshold

    Connection Protection is triggered when the number of read URL requests reaches the threshold you configure.

    6,000

    Duration (s)

    Protection duration. During this period, WAF stops forwarding client requests.

    60
    The following uses the values set in Figure 1 as an example to describe the effect.
    • Breakdown Protection: When the number of 502/504 errors returned by the protected website exceeds 1,000 and accounts for 90% or more of the total access requests of the website for the first time, the first breakdown protection is triggered. During the first breakdown protection, WAF stops forwarding client requests for 180s (that is, blocks visitors access to the website for 180s). If a second consecutive breakdown protection is triggered, WAF stops forwarding client requests for 360s (180 x 2). If a third or more consecutive breakdowns are triggered, WAF stops forwarding client requests for 540s (180s x 3). The breakdowns are counted from 0 when the total downtime duration exceeds one hour (3,600s).
    • Connection Protection: When the number of read URL requests in the waiting queue exceeds 6,000, WAF stops forwarding client requests for 60s and returns the maintenance page of the website to visitors.

Parent Topic: Recommended Configurations After Website Connection