Help Center/ Content Delivery Network/ Best Practices/ Preventing Traffic Theft/ Preventing Traffic Theft by Blocking Referers
Updated on 2026-05-20 GMT+08:00
View PDF
Share

Preventing Traffic Theft by Blocking Referers

The Referer header, carried in HTTP requests, identifies the address of the web page from which the resource has been requested. CDN PoPs can use this header to trace and identify the source.

Identifying Malicious Referers

Attackers often forge referers or use blank referers to bypass verification. You can use the logging and reporting feature provided by CDN to analyze and identify abnormal referers.

  1. Analyze offline logs in the attack period, check HTTP request information, identify abnormal IP addresses and anti-leeching information, and set protection rules accordingly. For details, see Analyzing Malicious Access Addresses Through Logs.
  2. Download and analyze custom operations reports such as popular URL, referer, UA, and client IP address reports. These reports are available if you have customized them for the domain name before an attack. For details, see Operations Reports.

    Set operations reports beforehand. If attacks cause a high bill before you configure them, you have to rely on offline logs for past data analysis.

Blocking Malicious Referers

After identifying abnormal referers, you can block access from these referers using the following method:

  1. Configure Referer validation to block access from abnormal referers.
    1. Log in to the CDN console.
    2. In the navigation pane, choose Domains.
    3. In the domain list, click the target domain name or click Configure in the Operation column.
    4. Click the Access Control tab.
    5. In the Referer Validation area, enable the function. The Edit Referer Validation dialog box is displayed.

      Type: Select Referer blacklist.

      Blank Referer: Select Block requests with blank referers.

      Rule: Enter the identified referer (www.example.com in this example).
      Figure 1 Editing referer validation
  2. Configure the rules engine to block access from the IP addresses.
    1. Log in to the CDN console.
    2. In the navigation pane, choose Domains.
    3. Click the Rules Engine tab and click Create Rule.

      Condition: Select HTTP request header.

      Name: Enter referer.

      Operator: Select Include any value.

      Value: Enter the identified referer (www.example.com in this example).

      Case sensitive: disabled.

      Actions: Select Access Control, with Type set to Reject.

      Figure 2 Configuring the rules engine
  3. Enable Edge security protection. You can use the precise protection feature provided by EdgeSec to block access from abnormal referers, preventing traffic theft.
Parent topic: Preventing Traffic Theft