DDoS protection and WAF: which threats they address and where other controls are needed

DDoS protection helps resist service overload from malicious traffic. A WAF inspects web requests and applies application protection rules. They complement each other without replacing code fixes or access management. Avoid blocking customers, integrations and required crawlers as well.

Distinguish overload from a harmful request

A volumetric attack may overload a link or infrastructure, while a request to a vulnerable form exploits an application flaw. Controls operate at different layers. Select them according to site architecture, provider capabilities and the required scenario.

Protection planning accounts for normal peaks and important operations. A campaign may cause a legitimate spike that should not automatically count as an attack. Establish baseline behaviour and a clear block-review procedure.

Verify the path to the origin server

When protection uses a proxy, establish which addresses actually traverse it. An unproxied subdomain or direct access may leave another route. Protect the origin through supported methods while preserving necessary operational connections.

Separately check TLS, client address forwarding and caching. Incorrect header trust can distort logs and rate limits. Overly broad acceleration rules must not place personalised pages into shared cache.

Test rules against forms and integrations

For example, a general browser challenge may block a payment webhook or partner API. Identify machine requests and apply suitable controls rather than disabling all protection. Limit exceptions to their purpose and verify their necessity.

Retest forms, sign-in, uploads and link sharing after changes. Agree search and AI crawler policies and use supported identification mechanisms. A User-Agent string alone does not prove the requester is the claimed bot.

Keep monitoring and an action plan

Assess matches in an available observation mode where supported. Then enable agreed blocking and test legitimate scenarios. Logs should show the reason, rule and path without exposing sensitive request contents.

Hand over provider escalation and rollback procedures. Application remediation remains separate: a WAF may reduce risk without proving the flaw is fixed. Review rules alongside new routes when the site changes.

Sources and further reading

• Cloudflare: security feature interoperability
• Cloudflare: origin server protection
• Google: verifying search crawlers

• Related subservice: DDoS protection and WAF
• Explore this service area