Solution · Security
DDoS protection and web application firewall
A distributed denial-of-service (DDoS) attack floods a website with traffic until real visitors cannot reach it. Online stores during sales, booking systems in high season, media sites during news events and any business with a determined competitor or a disgruntled former user can become a target. Protection is far cheaper to set up before an attack than during one.
[ 01 ]
In short
In short
- 01
Protection works in layers: a network or CDN layer absorbs volume, a web application firewall (WAF) filters malicious requests, and the application limits abuse.
- 02
The origin server's real address should be hidden, or attackers can bypass the protection layer.
- 03
Rate limits on logins, forms, search and APIs stop smaller, application-level attacks and bots.
- 04
Rules must be tuned so that real customers — including those on shared mobile network addresses — are not blocked.
- 05
A written plan says who does what when an attack starts, and how to communicate with customers.
[ 02 ]
Scope
Types of attacks
- Volumetric attacks try to saturate the network connection with sheer traffic. They are absorbed by providers with large networks.
- Protocol attacks exhaust server or network equipment resources with malformed or incomplete connections.
- Application-layer attacks send requests that look legitimate but are expensive for the server — searches, logins, heavy pages. They are harder to spot and need rules specific to your site.
More background in DDoS attack.
What we set up
Edge protection and CDN
Traffic goes through a provider with DDoS mitigation — often combined with a CDN that also speeds up the site. Volumetric and protocol attacks are absorbed there before they reach your server.
Web application firewall
A WAF inspects requests and blocks common exploit patterns such as injection attempts and known vulnerability scans. We start with managed rule sets and add rules for your application's specific weak points.
Origin protection
The server accepts traffic only from the protection provider, and its real IP address is not exposed in DNS records, email headers or old subdomains. Otherwise attackers go straight around the shield.
Rate limiting and bot management
Limits on how often an address can log in, submit a form, search or call an API. Challenges for suspicious traffic. Separate rules for legitimate bots such as search engine crawlers.
Caching and capacity
Pages and files that can be cached are served from the edge, so the server handles only what must be dynamic. The application is checked for endpoints that are slow enough to be abused.
Avoiding false positives
Aggressive rules can block real customers. Mobile operators often place many users behind shared addresses, and blocking one address can cut off a whole group. We tune rules on real traffic, monitor blocked requests after changes and keep an easy way to relax a rule quickly.
The incident plan
- How an attack is detected and who is alerted. See 24/7 monitoring.
- Emergency settings that can be switched on: stricter challenges, blocking by region or pattern.
- Contacts at the hosting and protection providers.
- A status message for customers and a channel to reach them if the site is down.
A practical overview for smaller companies is in DDoS protection for small business.
What we need from you
- Access to DNS, hosting and the site's configuration.
- Information about peak periods and past incidents.
- Any regions or partners whose traffic must never be blocked.
[ 03 ]
FAQ
Frequently asked questions
Is DDoS protection expensive?
Basic protection through a CDN provider is available at low cost or even free tiers; advanced application-layer protection and dedicated support cost more. We match the level to the business risk.
Will protection slow down the website?
Usually the opposite: the same providers cache content closer to visitors. The main risk is misconfigured rules, which is why tuning matters.
We are under attack right now. Can you help?
Yes. The first steps — routing traffic through a protection provider and hiding the origin — can often be done quickly, though DNS changes take some time to spread. Afterwards we review how the attack got through.