DDoS Protection
The Shield node filters HTTP floods. Volumetric attacks on the link are stopped by the datacenter network: a separate layer and a separate option.
Three layers.
Application Layer
HTTP floods and request abuse are filtered on the node itself: a per-IP request limit, WAF rules, cutoffs by IP, country, and path. Slowloris-style slow headers are closed after 10 seconds on HTTP/1.1 and 30 seconds on HTTP/2. This is not protection from volumetric attacks.
- ›HTTP flood
- ›Per-IP request limit
- ›IP / GEO / path rules
- ›Slow connections: 10 s (HTTP/1.1), 30 s (HTTP/2)
Volumetric attacks on the link
A volumetric flood fills the link before packets reach the server, so a server cannot stop it on its own. It has to be stopped on the datacenter network, ahead of the server. That is the separate protected IP option: always-on protection, your address is not null-routed, slightly higher latency. It is attached to the node separately.
- ›SYN, UDP, and ICMP floods
- ›Always-on, on the datacenter network
- ›No null-route during an attack
Origin hiding
You allow only Shield IPs on your server's firewall, so requests that bypass the node are dropped. Change your server's IP after onboarding so the old address is of no use to an attacker.
- ›Shield IPs only
- ›Server IP not in public DNS
- ›IP change after onboarding
Who stops what.
The goal they can't find.
Defense in the dark. No credit card. No footprint.