Mitigate L7 DDoS Attack

Reading time: About 3 minutes
Prerequisites: The hostname to be protected has been onboarded.

How to Identify an Ongoing Layer 7 DDoS Attack

Use the following signals to determine whether your website is under an L7 DDoS attack:

• Users report that the website is slow or inaccessible
• You receive an alert notification (a surge in Attack Requests or total requests)
• The request trend chart on the Dashboard or Analysis & Logs > Web Security Trends page shows a sharp spike

Incident Response Process

Step 1: Identify the Targeted Hostname

1. Configure alerts: Go to Analysis & Logs > Alert Management to set up alert rules. The alert content will directly indicate which hostname is under attack.

2. Go to Analysis & Logs > Web Security Trends

   • Check the Top Attack Targets panel to identify the hostname whose request volume is significantly higher than that of the other hostnames.

Step 2: Immediately Strengthen Protection

DDoS Protection Policy Configuration:

1. Go to Security Settings > Policies > [Hostname] and click the DDoS Protection tab.
2. Change the protection level from Moderate to Strict.
3. Make sure Adaptive Protection is enabled and set to Protection mode.

Step 3: Analyze Attack Signatures and Configure Rules

1. Go to Analysis & Logs > Security Analysis > Request Traffic.
2. Select the targeted hostname and focus on the attack time range.
3. Review the multi-dimensional traffic trend charts and Top Statistics.

• If the attack originates from concentrated IP ranges, click the IP/Geo Firewall tab and add a block rule.
• If the attack is concentrated on a specific path, click the Rate Limiting tab and create a strict rate-limiting rule for that path.
• If you observe a large volume of malicious strings, such as abnormal User-Agent or Referer values, click the Custom Rules tab and add a rule to block them.

Step 4: Continuous Monitoring (During the Attack)

Check the following every 15–30 minutes:

• Whether Attack Requests are trending down
• Whether the origin server’s response has returned to normal (confirm via your own monitoring system)
• Whether the attacker has switched tactics (new IP ranges, User-Agent, or paths)

Step 5: Wrap-Up After the Attack Ends

Determining that the attack has ended: Attack Requests have returned to the normal baseline level and remained there for more than 30 minutes.

Wrap-up actions:

1. Restore the DDoS protection level to Moderate (Strict mode may cause false positives that block legitimate users).
2. Review the temporary custom rules added during the attack and decide whether to keep them.
3. In the Sample Logs on the Security Analysis page, review the details of malicious requests and record the attack signatures (IP ranges, User-Agent, paths, etc.) for future hardening.
4. Assess whether the alert threshold needs to be adjusted.

Next Steps

After mitigating the attack, it is recommended that you strengthen your day-to-day protection to reduce the response cost the next time you are attacked:

• Configure Alert Management: Set up alerts for Attack Requests and total requests in advance so you can detect an attack immediately.
• Fine-Tune the DDoS Protection Policy: Based on this attack’s signature, lock in the appropriate protection level and AI Protection configuration.
• Make the most use of Security Analysis: Regularly review attack logs and sample logs to build up a library of attack signatures.