Sec-CMA for Anti-DDoS Proxy (Outside Chinese Mainland) uses a combined billing model: a monthly subscription covers your instance and base configuration, while pay-as-you-go charges apply only when traffic exceeds the subscribed limits.
Total fees = Subscription instance fees + Pay-as-you-go fees
Instance types
Sec-CMA provides secure acceleration and advanced mitigation for all protected services. Five instance types are available.
Which instance type should you choose? For new deployments, use Sec-CMA 2.0 — it supports all three Chinese mainland carrier lines and lets you select the number of advanced mitigation sessions at purchase. If you need unlimited mitigation, select the Unlimited option at purchase time instead of buying the legacy Sec-CMA 2.0 (Unlimited). The legacy Sec-CMA 1.0 variants are no longer available for new purchase.
| Instance type | New purchase | Protected carrier lines | Advanced mitigation sessions | Purchase extra sessions |
|---|---|---|---|---|
| Sec-CMA 1.0 | No. Contact your account manager. | China Telecom and China Unicom (Chinese mainland) | 2 per calendar month | Yes. Purchase a global advanced mitigation session. |
| Sec-CMA 1.0 (Basic Edition) | — | China Telecom and China Unicom (Chinese mainland) | 1 per calendar month | Yes. Purchase a global advanced mitigation session. |
| Sec-CMA 2.0 | Supported | China Telecom, China Unicom, and China Mobile (Chinese mainland) | No / 1 / 2 / Unlimited — select at purchase | Not supported. Select the desired specification at purchase. |
| Sec-CMA 2.0 (Insurance) | Supported. Note: This variant has been migrated to Sec-CMA 2.0. New purchases are not recommended. | China Telecom, China Unicom, and China Mobile (Chinese mainland) | 2 per calendar month | Not supported. Upgrade to Sec-CMA 2.0 or Sec-CMA 2.0 (Unlimited). |
| Sec-CMA 2.0 (Unlimited) | — | China Telecom, China Unicom, and China Mobile (Chinese mainland) | Unlimited | Not applicable |
Billing
Part 1: Subscription instance fees
Subscription instance fees = Basic instance fees + Fees for upgradable configuration items
Basic instance fees
| Instance type | Price (USD/month) |
|---|---|
| Sec-CMA 2.0 | Depends on the number of mitigation sessions configured at purchase: 0 sessions: 15.48 / 1 session: 7,740 / 2 sessions: 15,480 / Unlimited: 36,843 |
| Sec-CMA 1.0 | 15,480 |
| Sec-CMA 1.0 (Basic Edition) | 9,288 |
| Sec-CMA 2.0 (Insurance) | 15,480 |
| Sec-CMA 2.0 (Unlimited) | 36,843 |
The basic instance fee covers the following default specifications, which are the same across all instance types. You can upgrade any specification as needed.
| Specification | Default value | Billing method | Notes |
|---|---|---|---|
| Clean bandwidth | 10 Mbit/s | Subscription | Maximum service traffic the instance can process when no attacks occur. Scalable. |
| 95th percentile burstable clean bandwidth | Disabled | Pay-as-you-go | Charges apply when actual bandwidth exceeds clean bandwidth but stays below the 95th percentile burstable limit. |
| Clean queries per second (QPS) | 500 | Subscription | Maximum rate of concurrent HTTP and HTTPS requests. Scalable. Set this based on your actual service usage — exceeding the QPS limit causes packet loss and may result in incomplete logs. |
| 95th percentile burstable QPS | Disabled | Pay-as-you-go | Charges apply when actual QPS exceeds clean QPS but stays below the 95th percentile burstable limit. |
| Function plan | Standard function plan | Subscription | Standard and Enhanced plans available. The Enhanced plan provides advanced service access and DDoS attack mitigation capabilities. See Differences between the Standard and Enhanced function plans. |
| Number of protected domain names | 10 | Subscription | HTTP and HTTPS domain names the instance supports. Scalable. One root domain is supported per 10 domain names. For example, 50 domain names can span up to 5 root domains. |
| Number of ports | 5 | Subscription | TCP and UDP ports the instance can protect. Scalable. |
Fees for upgradable configuration items
Clean bandwidth
USD 1,548 per 10 Mbit/s increment per month.Price per 10 Mbit/s increment of clean bandwidth: USD 1,548 per month
Clean QPS
Pricing is tiered. For each increment, you pay the unit price for that tier only.
| QPS range | Unit price (USD/QPS-month) |
|---|---|
| 0 < QPS ≤ 500 | 0 |
| 500 < QPS ≤ 5,000 | 1.5 |
| 5,000 < QPS ≤ 8,000 | 1.425 |
| 8,000 < QPS ≤ 10,000 | 1.35 |
| 10,000 < QPS ≤ 50,000 | 1.275 |
| 50,000 < QPS ≤ 100,000 | 1.05 |
Example: Setting clean QPS to 6,000 gives a monthly fee of:
(500 − 0) × 0 + (5,000 − 500) × 1.5 + (6,000 − 5,000) × 1.425 = USD 8,175(500 - 0) × 0 + (5,000 - 500) × 1.5 + (6,000 - 5,000) × 1.425 = USD 8,175
Function plan
Enhanced function plan: USD 1,200/month.Enhanced function plan: USD 1,200/month
Number of protected domain names
| Domain names | Standard plan (USD/domain/month) | Enhanced plan (USD/domain/month) |
|---|---|---|
| 0 < n ≤ 10 | 0 | 0 |
| 10 < n ≤ 500 | 4.5 | 7.5 |
| 500 < n ≤ 1,000 | 4.1 | 7 |
| 1,000 < n ≤ 5,000 | 3.7 | 6.5 |
| 5,000 < n ≤ 10,000 | 3.2 | 5.8 |
| 10,000 < n ≤ 20,000 | 2.7 | 4.5 |
Example: Standard function plan with 600 protected domain names:USD per domain name-monthUSD/domain name/month
(10 − 0) × 0 + (500 − 10) × 4.5 + (600 − 500) × 4.1 = USD 2,615/month(5 - 0) × 0 + (50 - 5) × 30 + (80 - 50) × 26 = USD 2,130(10 - 0) × 0 + (500 - 10) × 4.5 + (600 - 500) × 4.1 = USD 2,615
Number of ports
| Ports | Unit price (USD/port/month) |
|---|---|
| 0 < n ≤ 5 | 0 |
| 5 < n ≤ 50 | 30 |
| 50 < n ≤ 100 | 26 |
| 100 < n ≤ 500 | 22 |
| 500 < n ≤ 1,500 | 18 |
Example: Setting 80 ports:
(5 − 0) × 0 + (50 − 5) × 30 + (80 − 50) × 26 = USD 2,130/month
End-to-end cost example
The following example shows the total monthly subscription fee for a typical Sec-CMA 2.0 instance.
Scenario: Sec-CMA 2.0 with 1 mitigation session, 30 Mbit/s clean bandwidth, 600 clean QPS, Enhanced function plan, 20 domain names, and 10 ports.
| Line item | Calculation | Fee (USD/month) |
|---|---|---|
| Basic instance fee (1 mitigation session) | — | 7,740 |
| Clean bandwidth upgrade (30 Mbit/s = 10 Mbit/s default + 20 Mbit/s extra) | 2 × 1,548 | 3,096 |
| Clean QPS upgrade (600 QPS) | (500 − 0) × 0 + (600 − 500) × 1.5 | 150 |
| Function plan upgrade to Enhanced | — | 1,200 |
| Protected domain names (20 names, Enhanced plan) | (10 − 0) × 0 + (20 − 10) × 7.5 | 75 |
| Ports (10 ports) | (5 − 0) × 0 + (10 − 5) × 30 | 150 |
| Total | 12,411 |
This total does not include pay-as-you-go charges.
Part 2: Pay-as-you-go fees
If your actual bandwidth and QPS stay within your subscribed clean bandwidth and clean QPS limits, no pay-as-you-go charges apply.
Enable pay-as-you-go features as needed. After enabling a feature, you are billed only when usage meets the billing conditions.
| Feature | Billing method | Description |
|---|---|---|
| 95th percentile burstable clean bandwidth | Daily or monthly pay-as-you-go | Provides additional bandwidth beyond the subscribed clean bandwidth limit, preventing rate-limiting during traffic spikes. See Billing of burstable clean bandwidth. |
| 95th percentile burstable QPS | Daily or monthly pay-as-you-go | Provides additional QPS beyond the subscribed clean QPS limit, preventing rate-limiting during peak traffic. See Burstable QPS billing. |
Expiration policy
| Time period | Traffic forwarding | Instance configuration |
|---|---|---|
| Within 6 calendar days after expiration | Blackhole filtering threshold drops to 5 Gbps. If combined service and attack traffic exceeds 5 Gbps, blackhole filtering is triggered. Secure acceleration is not provided. | Configuration retained |
| 7–14 calendar days after expiration | Traffic forwarding stops. Warning If you no longer need Sec-CMA, redirect traffic from the Anti-DDoS instance to your origin server at least 7 calendar days before the instance expires. For website services, update your DNS so your domain name no longer points to the Anti-DDoS instance CNAME. For non-website services, stop using the exclusive IP address of the instance. Failing to do so interrupts your services when the instance expires. | Configuration retained |
| Day 15 after expiration | Traffic forwarding stops. | Instance released. Warning After all Anti-DDoS Proxy instances under your account have been released for 30 days, the system automatically clears all associated domain and port forwarding rules. The 30-day countdown starts from the release of the last instance. |
Overdue payments
An overdue payment occurs when your available balance — including cash, coupons, and vouchers — is insufficient to cover your outstanding bill. Top up your account to restore a positive balance and prevent service interruptions.
Renewal
Renew instances manually or automatically. See Renew an instance.
Refunds
Refunds are not available after purchase.
Bill query
Query your bills in the Expenses and Costs console. See Overview of monthly bills.