Handling DDoS Attacks: Practical Defense for Hosting

DDoS attacks target availability. The goal isn’t just “block traffic”—it’s keeping legitimate users online while filtering the junk.

Understand the problem

Cloudflare’s learning center explains the basics and the mitigation concept clearly: what is a DDoS attack and DDoS mitigation.

Layered mitigation strategy

  • Edge protection: Anycast/CDN/WAF in front of origin
  • Rate limiting: throttle abusive patterns (login, API bursts)
  • Origin hardening: firewall rules, private origins, least exposure
  • Observability: detect spikes fast and confirm impact

Rate limit at the web server

NGINX provides first-class rate limiting via limit_req_zone and limit_req. See the official module docs: ngx_http_limit_req_module.

Discussion

What’s your current DDoS posture: CDN/WAF only, or do you also rate limit and firewall at origin?