Skip to main content
Talk to SalesGet Started

[SECURITY · CONTENT PROTECTION]

Your assets.Your rules.

Signed URLs, referer policies and country or IP ACLs - configured per CDN Resource without exposing secrets to browsers.

Four controls, one goal.

Stop unauthorized hotlinking, downloads and geographic abuse before bytes leave the edge.

  • Security Token

    Require a valid token in each request URL for private or time-limited content.

  • Hotlink Protection

    Allow or deny requests based on the Referer header and domain lists.

  • IP Restriction

    Whitelist or blacklist client IP addresses for a resource.

  • Geoblocking

    Block selected countries or allow only chosen regions to reach your content.

Policies you configure once.

  • Token key on the CDN

    Generate a token key in the Control Panel; your origin signs URLs - the CDN validates, never mints tokens.

    • Optional URI binding
    • Optional rate-limit parameters in the token
  • Referer whitelist or blacklist

    Match domains, wildcard domains or IPs; optionally allow requests with no Referer header.

  • IP ACL modes

    Whitelist trusted office or partner networks, or blacklist known abusive addresses.

  • Country policies

    Block selected countries or allow only selected ones when licensing or compliance requires it.

When content must stay private.

  • Time-limited downloads

    Issue expiring links for premium files or event replays.

  • Licensed media

    Combine geoblocking with tokens for region-specific rights.

  • Staging and internal sites

    IP whitelist staging hosts while production stays public.

  • Stop hotlinking

    Prevent other sites from embedding your CDN URLs without permission.

Pick the control you need.

  1. 01 / 03

    Open Security

    Select the CDN Resource that serves the assets you want to protect.

  2. 02 / 03

    Enable a policy

    Turn on Security Token, Hotlink Protection, IP Restriction or Geoblocking.

  3. 03 / 03

    Save and test

    Confirm changes, then verify legitimate clients and regions still work.

Serve content only to the audience you choose.

Talk to an engineer about tokens, geo rights and partner IP ranges.

Talk to an engineer