Multi-Layer DDoS Protection Setup for Your Website

A DDoS attack can take your site down in seconds if you're not protected. A network flood at L3/L4 or a clever HTTP flood at L7 can overwhelm even a powerful server. We help set up comprehensive protection against all attack types. With over 10 years in production (Bitrix, 1C, web development) and 40+ projects, we know the drill. Contact us for an audit of your infrastructure.

One client — a WooCommerce online store — was losing up to 30% of revenue due to periodic DDoS attacks. After our configuration, the site survived a 1000 RPS attack with response time under 200 ms. Contact us for an audit.

Why Standard Protection Isn't Enough?

Often developers rely on a single layer: throw in Cloudflare or enable rate limiting. That's not enough. Attackers adapt: bypass simple limits, mimic legitimate traffic. OWASP recommends multi-layer protection — only by combining CDN, rate limiting, behavioral analysis, and monitoring can you guarantee stability.

How We Set Up Protection Turnkey

We use proven tools and configure each layer individually. Cloudflare Free/Pro automatically covers L3/L4 attacks. For L7, we additionally configure rate limiting and behavioral filters. Result: your site withstands attacks of 500+ RPS without performance loss.

Example Cloudflare Configuration

• Security > DDoS > HTTP DDoS attack protection — Sensitivity High, Action Block (start with Log)
• Security > Settings — Security Level Medium/High, Bot Fight Mode ON, Browser Integrity Check ON
• During active attack, enable Under Attack Mode — all visitors go through a JS challenge

Rate Limiting in Nginx

# Limit zones — inside http block
limit_req_zone $binary_remote_addr zone=api:10m rate=30r/m;
limit_req_zone $binary_remote_addr zone=login:10m rate=5r/m;
limit_conn_zone $binary_remote_addr zone=perip:10m;

server {
    # API — 30 requests per minute
    location /api/ {
        limit_req zone=api burst=10 nodelay;
        limit_req_status 429;
    }

    # Login form — 5 attempts per minute
    location /login {
        limit_req zone=login burst=3 nodelay;
        limit_req_status 429;
    }

    # Max 20 concurrent connections per IP
    limit_conn perip 20;
}

Rate Limiting in Application (Laravel)

// routes/api.php
Route::middleware('throttle:60,1')->group(function () {
    Route::get('/data', [DataController::class, 'index']);
});

// Custom limits with different rules for authenticated users
Route::middleware('throttle:api')->group(function () {
    // ...
});

// config/app.php or RouteServiceProvider
RateLimiter::for('api', function (Request $request) {
    return $request->user()
        ? Limit::perMinute(120)->by($request->user()->id)
        : Limit::perMinute(30)->by($request->ip());
});

SYN Flood at Linux Kernel Level

# /etc/sysctl.conf
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 3
# Apply
sysctl -p

Fail2ban for HTTP Flood

# /etc/fail2ban/filter.d/nginx-req-limit.conf
[Definition]
failregex = limiting requests, excess:.* by zone.*client: <HOST>

# /etc/fail2ban/jail.d/nginx.conf
[nginx-req-limit]
enabled = true
filter = nginx-req-limit
logpath = /var/log/nginx/error.log
maxretry = 10
findtime = 60
bantime = 600

Geo-blocking

During an attack from specific regions — temporary block via Cloudflare or GeoIP in Nginx:

# MaxMind GeoIP2 geoip2 /usr/share/GeoIP/GeoLite2-Country.mmdb {
    $geoip2_country_code country iso_code;
}
map $geoip2_country_code $blocked_country {
    default 0;
    CN 1;
    RU 0; # Don't block your own audience
}
if ($blocked_country = 1) {
    return 403;
}

Protection Level Comparison

DDoS Protection Solution Comparison

Cloudflare is better suited for small and medium businesses: it's 2-3 times cheaper than alternatives with comparable L7 protection. Order a protection setup and get a stability guarantee.

How to Choose the Protection Level?

Determine which attacks are most likely for your project. If it's a low-traffic informational portal, Cloudflare Free and basic rate limiting are enough. For an online store or high-traffic API, you need the full stack: CDN, WAF, behavioral analysis, and monitoring. We'll help select a configuration for your budget and load. Contact us for an audit.

How to React Quickly to a DDoS Attack?

At the first signs of an attack (increase in 5xx, drop in LCP), immediately enable Under Attack Mode in Cloudflare. Then check Nginx logs for anomalous IPs and custom URIs. If the attack continues, activate Fail2ban with the nginx-req-limit filter. As a last resort, temporarily block the source country via GeoIP. We stand by 24/7 and can deploy protection within 30 minutes.

What's Included in the Work?

• Audit of current protection and vulnerability identification
• CDN integration with DDoS protection (Cloudflare)
• Rate limiting configuration on Nginx and application level
• Fail2ban installation with custom filters
• Monitoring setup (Grafana + Prometheus, alerts)
• Documentation and training for your team
• 30-day configuration guarantee

Setup Process

1. Audit — analyze current infrastructure, logs, load
2. Design — select optimal stack and rules
3. Implementation — configure all protection layers
4. Testing — simulate attacks, verify correctness
5. Deploy — move to production with monitoring

Timelines

• Cloudflare integration + basic rules: 1 day
• Rate limiting + Fail2ban: 1-2 days
• Monitoring and alerts: 1 day
• Full turnkey package: up to 5 days

Pricing is calculated individually — contact us for an estimate. Want to protect your site? We'll assess your infrastructure as part of the estimate. Contact us.