DDOS Attack mitigation
Defending against traffic floods designed to exhaust your capacity — absorbed at the edge, filtered by layer, and increasingly a cost problem as much as an uptime problem.
Last reviewed: July 25, 2026
What is DDoS mitigation?
A distributed denial-of-service attack aims traffic from thousands of sources at your infrastructure until something exhausts — bandwidth, connection tables, CPU, or your autoscaling budget. Mitigation is layered by where the attack lands: L3/4 volumetric floods (UDP amplification, SYN floods) measured in Tbps must be absorbed by networks bigger than yours; L7 application floods look like legitimate HTTP requests and must be distinguished, not just absorbed.
The modern defense stack
Volumetric defense is effectively outsourced: anycast CDNs and provider shields (Cloudflare, AWS Shield, Google Cloud Armor) spread attacks across global capacity that dwarfs any single origin — this layer is table stakes and largely automatic. L7 is where your work lives: rate limiting per token/IP/session, bot scoring, caching aggressively so attacks hit cache instead of origin, and keeping the origin unreachable except via the edge (an origin IP leaked in DNS history is a bypass around your entire shield). For APIs, authenticated-endpoint rate limits matter more than homepage protection — attackers target your expensive endpoints, like search and LLM inference.
The economic angle nobody budgets
In serverless and autoscaling architectures, an attack that never causes downtime can still cause a bill — “denial of wallet.” Spend alarms, hard concurrency caps, and per-client quotas are DDoS mitigations. AWS Shield Advanced’s cost-protection refunds exist because this failure mode is common enough to insure.
What people get wrong
- Protecting the website, not the API — scrapers and floods concentrate on unauthenticated API routes.
- Testing mitigation never: rate limits configured years ago fail open, block legitimate spikes, or both; validate against load tests.
- Assuming the CDN covers everything — WebSocket endpoints, direct-to-origin paths, and DNS itself need their own story.
Primary source: Cloudflare — What is a DDoS attack?
Common Mitigation Techniques
DDoS mitigation typically combines several layers: traffic scrubbing services that filter malicious traffic before it reaches origin infrastructure, rate limiting to cap how many requests a single source can make in a given time window, and anycast routing, which distributes incoming traffic across many geographically dispersed points of presence so that even a very large attack’s traffic gets spread thin across a wide network rather than overwhelming a single origin server. Cloud providers’ native DDoS protection services (like AWS Shield or Cloudflare’s network) operate at this infrastructure level, automatically absorbing and filtering volumetric attacks that would otherwise be impossible for an individual application server to withstand on its own, making managed DDoS protection close to a baseline expectation for any public-facing production service today rather than an optional add-on.
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.