# L7 Shield

> Put a domain behind the managed L7 edge — WAF, rate limits, bot challenges and load-balanced origins, with the Cloudflare DNS cutover handled for you.
>
> Canonical: https://xdp.network/docs/products/l7-shield · Updated 2026-08-17

L7 Shield puts one of your hostnames behind a managed layer-7 edge node: the edge
terminates TLS, filters attacks (WAF, per-IP rate limits, bot challenges) and
load-balances what's left across your origin backends. You connect a domain from the
product page; the platform installs the site on an edge node and can cut your
Cloudflare DNS over for you.

You need a connected Cloudflare account (added once from the dashboard overview) and
at least one running origin the edge can reach.

## Connect a domain

Open the L7 Shield product page and choose **Connect a domain**. The wizard walks
through:

1. **Cloudflare account** — pick one of your connected accounts. The edge reads DNS
   through it to cut the hostname over; credentials never leave the platform.
2. **Zone** — the domain the hostname lives under, listed live from the Cloudflare API.
3. **Hostname** — a subdomain of the zone, or `@` for the zone root.
4. **Node** — pick an edge node, or leave **Automatic** (recommended) to be placed on
   a node with headroom. Only nodes your plan may use are listed; when none are
   user-selectable the step is skipped and placement is always automatic.
5. **Backends** — 1–16 origin URLs (`http(s)://host[:port]`) with weights, plus a
   balance policy: round robin, random, least connections, or weighted.
6. **SSL certificate** — **Self-signed on the edge** (recommended; browsers never see
   it while DNS is proxied through Cloudflare) or **Paste my own** fullchain + private
   key, stored encrypted and only ever sent to your edge node.
7. **Protection** — per-IP rate limit (requests per window), the over-limit action
   (block with 429, or a JS challenge), an optional repeat-offender ban duration, the
   WAF toggle, and the challenge mode (off, auto, or always).
8. **DNS** — leave the cutover on and the platform points the hostname at the edge
   with a proxied A record, stashing any existing record first. Turn it off to manage
   the record yourself.
9. **Review** — confirm, then watch the live progress (edge install, DNS cutover,
   live). A failed step offers **Retry**.

## The site detail page

Click a site to open its detail page. Three tabs:

- **Overview** — current status with actions (re-apply the config, retry a failed DNS
  cutover, delete), the backend list, protection summary, site details (zone, node,
  edge site id, certificate type), the DNS card, and a status timeline built from the
  install jobs.
- **Analytics** — see the next section.
- **Control** — edit backends, the balance policy and protection settings, then
  **Save + re-apply** (the node picks the change up on its next heartbeat). The DNS
  card here applies or rolls back the cutover, and the danger zone deletes the site.

## Analytics

The Analytics tab reads per-minute rollups the edge piggybacks on its heartbeats
(48h retention). It opens with a **checks strip** — pass/warn/fail chips for site
status, DNS cutover, backends and mitigation, computed from signals the platform
already has.

- Toggle **Live** to refresh every 5 seconds (the range locks to 1 hour); otherwise
  pick 1 or 24 hours.
- The metric filter switches the headline chart between **Requests** (req/min + rps),
  **Threats** (blocked vs challenged per minute) and **Connections** (active). A
  second chart always shows the mitigation share — blocked/challenged as a percentage
  of requests.
- **RPS range stats** summarize the range: latest, p95 and peak.
- **Top countries** breaks requests, blocked and challenged down per country over the
  selected range, and the attack-origins map below plots the same GeoIP data with
  live, 1h, 24h and 48h ranges.
- **Per-backend stats** shows each origin's in-flight requests, cumulative failures
  (with a +/min rate) and state — a backend that fails repeatedly cools down for a
  10-second passive failover.

## DNS cutover and rollback

With managed DNS on, cutover stashes your existing A/AAAA/CNAME record and replaces
it with a proxied A record pointing at the edge node's IP. **Roll back** restores the
stashed record exactly (or deletes the record if the platform created it). You can
cut over and roll back at any time from the Control tab or the Overview's DNS card.

## Transfers between nodes

Support staff can move a site to a different edge node — for capacity, latency or a
node drain. The move keeps your spec and certificate, re-points the managed DNS
record at the new node's IP, and shows as a `transferring` status while it runs.

## Deleting a site

Delete offers two modes:

- **Graceful** (default) — rolls the DNS record back (best-effort), then the edge
  tears the site down on its next heartbeat. The row stays as "torn down" until the
  edge confirms; deleting a torn-down site removes the row and its metrics.
- **Force delete** — removes the row and its metrics immediately, with DNS rollback
  and the edge teardown only best-effort. Use it when the node is offline or the
  site is stuck.

:::warning
Deleting a site stops the edge from serving the hostname. With graceful delete the
DNS rollback happens first, so traffic returns to your origin as the record
propagates — with force delete, verify the record yourself afterwards.
:::

## Next steps

- [L4 Tunnel](/docs/products/l4-tunnel)
- [Cloudflare connections, Analytics and Auto Setup](/docs/products/cloudflare)
- [Health Monitor](/docs/servers/health-monitor)