How to Apply for a Free Trial of a High-Defense CDN: Materials, Onboarding Sequence, and Verification Points During the Trial Period

Applying for a free trial of a high-defense CDN: the real time sink isn't submitting the form, but three things: clearly describing your business requirements in one go (which determines approval speed and whether you get a suitable environment), onboarding in the correct sequence (which determines whether your service will experience hiccups during the trial), and verifying the right metrics within the limited trial window (which determines whether your conclusions are useful).

Below, we break down these three aspects. First, identify your situation, because the application path and testing focus differ.

First, Distinguish: Emergency Onboarding or Procurement PoC

Currently under attack. In this case, don't follow the standard trial process slowly. Contact pre-sales through the emergency channel directly, explain the current symptoms (inaccessible/intermittent 502/CPU or bandwidth maxed out), business type, origin IP, and approximate peak, and ask them to allocate scrubbing nodes and configure policies before onboarding. The "test" in this scenario is essentially a real-world validation with actual attack traffic; the goal is to restore access first, and verification happens as a byproduct. If you haven't completed the basic stop-the-bleeding actions, first follow the sequence in How to Quickly Restore Access After a DDoS Attack on Your Website, then discuss onboarding.

Daily selection PoC. You control the timing. The focus is not "can it withstand attacks" but node coverage and latency, the granularity of protection rules, false positive rate, and billing method. This type of test is worth spending an extra day or two to run through dynamic APIs and login/payment paths.

Information to Prepare Before Applying: These Items Determine Approval Speed

The information pre-sales needs is basically fixed; providing it all at once saves two or three rounds of back-and-forth:

• Business type and protocols. HTTP/HTTPS website, WebSocket, or pure TCP/UDP APIs. This item has the highest priority because it determines whether you should use a regular high-defense CDN. Web pages and APIs over a Layer 7 CDN are fine; battle games, proprietary protocols, and UDP-heavy businesses typically require encapsulation access like a game shield. For criteria, refer to How to Choose Between Game Shield and High-Defense CDN and Can UDP Battle Servers Under Attack Use CDN Protection. Get this step wrong, and even if you're given a test environment, it's useless.
• Domain list. Which subdomains are for the main site, API, backend, and static resources; which need protection and which stay untouched for now.
• Origin IP and back-to-origin port, whether there are multiple origins, and whether there's already a load balancer or reverse proxy in front.
• Line requirements. If access is primarily from mainland China, ask whether you can use CN2 direct connection without ICP filing; for multi-region access, look at global node distribution. For the relationship between node location and ICP filing, see Does High-Defense CDN Require ICP Filing.
• Current status materials (when under attack). Attack time window, log snippets, peak bandwidth and QPS—provide as much as you have; policies can be configured more accurately.

One uncertainty to accept in advance: free trial durations vary significantly among providers, and generally require manual review; restrictions are usually stricter for domains without ICP filing or for individual entities. Don't treat a specific number of days as a given when planning migration; set the window after receiving the review result.

Action Sequence from Application to Traffic Switching

1. Apply for the environment. Self-service registration and activation, or submit a ticket/business inquiry to request a trial account and policies.
2. Add the protected domain, fill in the real origin IP and back-to-origin port. If multiple origins, fill in all; also confirm whether the back-to-origin protocol is HTTP or HTTPS.
3. Configure certificates. Upload an existing certificate or enable automatic free SSL. If this step isn't done properly for an HTTPS site, you'll get certificate errors after switching traffic.
4. Start with loose policies, then tighten. Use default or relatively lenient settings for WAF rules, CC rate limiting, and region blocking initially; gradually tighten after confirming normal operation. Starting with the strictest settings makes it easy to mistake false positives for "protection working."
5. Validate locally first, then change DNS. Use hosts to point the domain to the assigned node address, and click through the homepage, login, checkout, file upload, WebSocket, and third-party payment callbacks. Confirm everything is fine before touching DNS resolution.
6. Switch CNAME. Lower the TTL to a short value before switching for easy rollback. Whether to change NS is a separate matter; the two access methods differ in propagation speed and protection boundaries. See Should You Change NS When Onboarding a High-Defense CDN.

Four Types of Things to Actually Verify During the Trial

Availability and False Positives

False positives are more likely to cause problems than defense data. Check item by item: are login/registration, checkout/payment, backend management, file upload, long connections, third-party callbacks, and Webhooks being blocked? Also check whether search engine crawlers are blocked—filter by UA and crawl frequency in the log panel, or run a crawl diagnostic on the search platform. Also monitor the frequency of CAPTCHA challenges; too frequent means driving away customers.

Latency and Back-to-Origin Quality

Test across multiple regions and ISPs, focusing on dynamic API response times, not just static resources on the homepage—static numbers always look good after cache hits. Also confirm static resource cache hit rates, back-to-origin connection stability, and whether long connections are cut off mid-way. For cross-border business, also check return path routing; for methods, refer to Route Verification and Capacity Boundaries for Global Accelerated Network Cross-Border Access.

Whether the Origin's Real IP Is Hidden

This step is often skipped, but it determines whether protection can be bypassed. Do at least two things: configure the origin firewall to only allow back-to-origin IP ranges from high-defense nodes (plus necessary operations IPs) and deny everything else; then proactively check historical DNS records, subdomains, email services, certificate transparency logs, and error pages for leaked original IPs. For a complete checklist, see How to Hide the Origin. If not locked down, attack traffic can bypass the CDN and hit the origin directly, making trial conclusions meaningless.

Conduct Defense Verification Compliantly

To verify scrubbing effectiveness, don't look for "stress testing" services—many are actually attack services, and launching traffic tests against targets without written authorization is illegal. Three feasible approaches: conduct limited stress tests on your own assets with the provider's permission and within an agreed time window; directly use interception curves, log panels, and alert notifications from real attacks (e.g., whether Telegram notifications arrive promptly); and separately observe behavioral metrics for attack types that don't rely on large traffic—for slow CC, judgment doesn't rely on bandwidth. See How to Determine If It's a Slow CC Attack.

Billing Terms to Clarify Before Committing

The trial is free, but billing risks are in the contract. With traffic-based billing, attack traffic is also billed; a single burst of large-traffic attack can result in a bill far exceeding budget. With fixed peak-based billing and unlimited traffic, the cost ceiling is more controllable, and a sudden attack won't cause runaway costs due to traffic spikes.

Before signing, clarify these points: how the peak is calculated, how exceeding the peak is handled (rate limiting or surcharge), whether defense capabilities are included in the base fee or require separate purchase, and whether trial configurations can be migrated as-is to the production environment. RockCloud completes acceleration and defense on the same link, charged as one fee; defense is not a separate purchase, peak-based billing with unlimited traffic, and supports contract quotes and free trials—specific tiers and application entry are on the Plans and Free Trial page. If your business is under attack right now, don't queue through the PoC process; go directly to the Emergency Onboarding Entry and explain the current situation.

Final Steps When Moving Trial Conclusions to Production

If you decide to commit, switch in this order: lower DNS TTL → switch a secondary subdomain first and observe for a day → then switch the main site → after stabilizing, tighten WAF and CC policies → finally change the origin IP once to completely invalidate old IPs that may have been exposed during the trial. Prepare a rollback plan in advance: keep a copy of the original DNS records so you can revert within minutes if problems arise.

In one sentence, the key to this: the value of a free trial depends on what you verify during the window. Defense data is provided by the vendor, but false positives, latency, whether the origin is locked down, and billing terms can only be confirmed by testing and asking yourself.