Adobe Commerce Advanced Security
Adobe Commerce Advanced Security is a product that works with Adobe Commerce on Cloud Infrastructure to keep your online store fast, available, and secure. This can help protect revenue, reduce downtime, and maintain customer trust during peak traffic events and automated attacks.
Adobe Commerce on Cloud Infrastructure includes built-in Layer 3 and 4 DDoS protection and a Web Application Firewall (WAF). Under the shared responsibility model, Layer 7 DDoS detection, bot protection, and proactive IP blocking are merchant responsibilities, which Adobe Commerce Advanced Security is designed to address.
Advanced Security extends storefront protection through Fastly-powered edge security capabilities, which delivers bot management, advanced rate limiting, and Layer 7 DDoS protection as part of a unified edge platform that combines scale, performance, and security at the network edge.
Core capabilities
Adobe Commerce Advanced Security includes the following additional protections:
-
Bot Management—Identifies and mitigates unwanted bot activity on your web applications. The Bot Management service distinguishes between legitimate bots (search engine crawlers, social media bots) and malicious ones, providing real-time classification at the network edge with options to block, allow, challenge, or rate-limit traffic.
-
DDoS Protection—Provides Layer 7 (application layer) DDoS protection beyond the existing Layer 3 and 4 protection included with all Adobe Commerce on Cloud Infrastructure projects. The DDoS Protection service absorbs large-scale volumetric attacks and ensures continuous application availability during distributed denial-of-service (DDoS) events, protecting revenue during peak traffic periods.
-
Advanced Rate Limiting—Provides configurable rate limiting rules that protect specific URLs, API endpoints, and application resources from abuse. The Advanced Rate Limiting service goes beyond the basic rate limiting available through the Fastly CDN module to target specific traffic patterns and attack vectors, reducing infrastructure strain and cloud costs.
Threat coverage
Advanced Security protects storefronts from a range of automated and application-layer threats.
Bot-driven abuse
- Credential stuffing—Automated attempts to log in using stolen credentials from data breaches.
- Account takeover—Bots that attempt to gain unauthorized access to customer accounts.
- Account creation abuse—Automated creation of fake accounts for fraud or abuse purposes.
- Card testing—Bots that test stolen credit card numbers against your payment processor.
- Content scraping—Automated extraction of product data, pricing, or content from your storefront.
- Inventory hoarding—Bots that hold products in carts to prevent legitimate purchases.
AI bot management
- AI crawler detection—Identifies and manages AI crawlers that scrape content to train large language models without consent.
- AI fetcher control—Controls AI fetchers used in real-time AI search results.
- Configurable AI bot policies—Distinguishes between verified and suspected AI bots with configurable signal types for policy enforcement.
Application-layer attacks
- Layer 7 DDoS attacks—Distributed attacks targeting the application layer that bypass built-in Layer 3 and 4 protections. Advanced Security absorbs these volumetric attacks at the edge before they reach your origin servers.
- URL and API abuse—Attacks targeting specific URLs or API endpoints spread across a large number of IP addresses, where individual IP blocking is not effective.
- Cache-busting attacks—Requests with manipulated query parameters designed to bypass CDN caching and overwhelm the origin server.
Additional capabilities
- Dynamic Challenges—Automatically assigns the optimal challenge to suspicious traffic. Leverages Private Access Tokens (PAT) to seamlessly validate a portion of requests without impacting the user experience.
- Deception technology—Addresses account takeover attempts by returning false information to attackers, mitigating their attack while disrupting their ability to operate at scale.
Choosing the right protection
Use the following guidance to determine whether Advanced Security is the right solution for your storefront protection needs, or whether existing protections or alternative solutions are more appropriate.
When to use Advanced Security
The following scenarios are best addressed with Advanced Security:
When to use existing protections
The following scenarios are best addressed with existing protections:
When to use alternative protections
The following scenarios are best addressed with alternative protections that can complement Advanced Security:
Security stack positioning
Advanced Security fits within the broader Adobe Commerce security architecture as an additional layer of edge-based protection. It works alongside — and does not replace — the WAF and Layer 3/4 DDoS protections already included with Adobe Commerce on Cloud Infrastructure. The following sections clarify how it relates to existing protections and the responsibilities that remain with the customer.
Included protections
Adobe Commerce on Cloud Infrastructure includes the following security features:
- Web Application Firewall (WAF)—Managed protection against SQL injection, Cross-Site Scripting (XSS), and other Open Web Application Security Project (OWASP) Top Ten threats. Available on Production environments only.
- Layer 3 and 4 DDoS protection—Built-in protection against network-layer attacks such as SYN floods, UDP floods, ICMP-based attacks, and TCP-level attacks. Enabled automatically with Fastly CDN.
- SSL/TLS certificates—Domain-validated encryption certificates for secure HTTPS traffic.
- Origin cloaking—Ensures all traffic routes through Fastly, blocking direct access to origin servers.
- VCL-based security snippets—Custom Varnish Configuration Language (VCL) rules for IP blocking, allowlisting, and request filtering.
Advanced Security
Advanced Security provides increased protection beyond the built-in protections included with Adobe Commerce on Cloud Infrastructure, but at an additional cost:
- Bot Management—Edge-based bot detection and mitigation with AI bot management.
- Layer 7 DDoS Protection—Application-layer DDoS absorption and defense.
- Advanced Rate Limiting—Granular rate controls for URLs and API endpoints.
- Dynamic Challenges and Deception Technology—Automated challenge assignment and account takeover mitigation.
Customer responsibility
- Fraud prevention—Transaction-level fraud scoring and payment fraud detection.
- Identity and access management—Customer authentication, authorization, and session management.
- Application security testing—SAST/DAST and vulnerability scanning.
- Custom security configurations—VCL-based rules, IP allowlists, and blocklists.
- Compliance tooling—PCI scanning, SOC compliance reporting, and regulatory audit tools.
- Application-level hardening—Token-based API authentication, query parameter normalization, and caching strategy design.
For a complete overview of Adobe and customer security responsibilities, see the shared responsibility model.
Common attack patterns and protections
The following table maps common attack patterns to the appropriate protection layer within the Adobe Commerce security stack.
WAF blocking behavior
The following WAF behavior applies to all Adobe Commerce on Cloud Infrastructure projects, regardless of whether Advanced Security is enabled. The included WAF service uses the following blocking behavior for common attack signals:
- SQL injection requests are blocked immediately, even for a single matching request.
- Requests identified with the following threat signals from a known malicious IP are blocked immediately: Backdoor, Attack Tooling, CMDEXE, Log4J JNDI, Traversal, and XSS.
- Requests from non-malicious IPs that exhibit the above threat signals are blocked when they exceed the following thresholds:
Request Advanced Security
To request Advanced Security:
-
Contact your Adobe Account team or Adobe Sales representative to discuss Advanced Security for your project.
-
After purchasing Advanced Security, submit an Adobe Commerce Support ticket requesting Advanced Security enablement. Include your Adobe Commerce on Cloud Infrastructure project ID and the environments requiring enablement (for example, Production and Staging).
-
Adobe activates Advanced Security on your Fastly service and configures the initial protection policies. Enablement is usually completed within a few business days of ticket submission.
-
You receive confirmation that Advanced Security is active, along with details about the protections enabled for your environments.
Limitations
Advanced Security provides edge-layer storefront protection. The following capabilities are not available and are best addressed with complementary solutions:
- Transaction-level fraud scoring—Advanced Security does not evaluate individual payment transactions for fraud risk. Use a dedicated fraud prevention platform for transaction-level scoring.
- Identity and access management (IAM)—Advanced Security does not manage user authentication, authorization, or session management. These remain customer responsibilities.
- Static and dynamic application security testing (SAST/DAST)—Advanced Security does not include code-level vulnerability scanning or penetration testing.
- API security—While Advanced Rate Limiting can protect API endpoints from abuse, comprehensive API security features such as schema validation and API gateway management are not provided.
- Full fraud prevention—Advanced Security focuses on edge-layer storefront protection and is not a complete fraud management platform.
- Compliance tooling—Advanced Security does not provide PCI scanning, SOC compliance reporting, or regulatory audit capabilities.