DDOS Attack mitigation
Defending against traffic floods designed to exhaust your capacity — absorbed at the edge, filtered by layer, and increasingly a cost problem as much as an uptime problem.
What is DDoS mitigation?
A distributed denial-of-service attack aims traffic from thousands of sources at your infrastructure until something exhausts — bandwidth, connection tables, CPU, or your autoscaling budget. Mitigation is layered by where the attack lands: L3/4 volumetric floods (UDP amplification, SYN floods) measured in Tbps must be absorbed by networks bigger than yours; L7 application floods look like legitimate HTTP requests and must be distinguished, not just absorbed.
The modern defense stack
Volumetric defense is effectively outsourced: anycast CDNs and provider shields (Cloudflare, AWS Shield, Google Cloud Armor) spread attacks across global capacity that dwarfs any single origin — this layer is table stakes and largely automatic. L7 is where your work lives: rate limiting per token/IP/session, bot scoring, caching aggressively so attacks hit cache instead of origin, and keeping the origin unreachable except via the edge (an origin IP leaked in DNS history is a bypass around your entire shield). For APIs, authenticated-endpoint rate limits matter more than homepage protection — attackers target your expensive endpoints, like search and LLM inference.
The economic angle nobody budgets
In serverless and autoscaling architectures, an attack that never causes downtime can still cause a bill — “denial of wallet.” Spend alarms, hard concurrency caps, and per-client quotas are DDoS mitigations. AWS Shield Advanced’s cost-protection refunds exist because this failure mode is common enough to insure.
What people get wrong
- Protecting the website, not the API — scrapers and floods concentrate on unauthenticated API routes.
- Testing mitigation never: rate limits configured years ago fail open, block legitimate spikes, or both; validate against load tests.
- Assuming the CDN covers everything — WebSocket endpoints, direct-to-origin paths, and DNS itself need their own story.
Primary source: Cloudflare — What is a DDoS attack?
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.