How do you configure CloudPages security settings, including SSL and custom domains?

CloudPages are hosted on Salesforce-managed infrastructure with the following security options:
SSL: All CloudPages served over HTTPS by default on Salesforce domains. For custom domains, you provide an SSL certificate (or Salesforce provisions one via Let's Encrypt) and configure a CNAME DNS record pointing your custom domain to the CloudPages endpoint.
Custom domain setup: In CloudPages Setup, add a custom domain, verify DNS ownership via a TXT or CNAME record, then associate it with a CloudPages collection. Custom domains improve brand trust and deliverability of CloudPages links in emails.
WAF (Web Application Firewall) and DDoS protection: Salesforce provides platform-level WAF and DDoS protection for all CloudPages. Customers cannot configure custom WAF rules at the application layer but can contact Salesforce Support for IP allowlisting.
Access control: CloudPages do not have native authentication (login walls) out of the box. Use AMPscript token validation, query string parameters, or Marketing Cloud personalisation strings to control who can view content on a page.