# DDoS Protection Checklist: 12 Steps Every Engineering Team Should Take

> From rate limiting and WAF rules to DNS-based scrubbing and incident runbooks — a practical checklist you can implement this week to harden your infrastructure.

- Category: Best Practices
- Author: Akarguard Team, Security Engineering
- Published: Sep 13, 2026
- Canonical: https://akarguard.net/blog/ddos-protection-checklist

---

DDoS protection is not a single product you install and forget — it is a layered defence, and the layers are where most teams have gaps. This checklist gives you twelve concrete steps, grouped from the network layer up through the application layer to overall resilience, ordered so you can start with the quick wins today and work toward the deeper architectural changes. None of it is exotic; the value is in doing all of it rather than half.

## Network Layer (L3/L4)

- Enable BCP38 / ingress filtering at your network edge to reject spoofed source IPs.
- Hide your origin IP behind a reverse proxy (a DNS change with Akarguard) so a direct volumetric flood has no target — but stop the raw flood itself upstream, at your host or transit provider.
- Rate-limit ICMP, UDP and SYN at the firewall.
- Disable unused UDP services exposed to the internet (DNS, NTP, Memcached) so you are not an amplifier.
- Keep your origin server IP confidential — never let it appear in a public DNS record.

## Application Layer (L7)

- Deploy a Web Application Firewall with rate-limiting rules per IP and per session.
- Enable a CAPTCHA or JavaScript challenge on high-traffic endpoints when traffic looks anomalous.
- Apply connection limits and request throttling at your proxy or load balancer.
- Cache static assets aggressively — a cached response never touches your app server.

## Infrastructure & Resilience

- Use a DDoS-resistant DNS provider — your DNS being reachable matters as much as your application.
- Run regular load tests so you know your real breaking point before an attacker finds it.
- Document a DDoS response runbook: who to call and what to do in the first five minutes.

> **The step teams most often miss** — Teams spend days hardening servers and forget their DNS entirely. If your DNS goes down, none of the rest matters — the site is unreachable regardless. Put a DDoS-resistant DNS provider on the list and treat it as critical, not an afterthought.

## How Akarguard Covers the List

Several of these steps are exactly what Akarguard does for you once your domain is routed through it: it hides your origin, applies a WAF and per-IP/per-session rate limits, offers JavaScript-challenge and CAPTCHA protection modes, enforces connection limits, and can cache at the edge — all managed from one panel, with automatic mitigation on top. Two items stay outside its scope and belong in your plan regardless: raw volumetric filtering is handled upstream by your host or transit provider, and DNS-layer protection requires a dedicated DDoS-resistant DNS provider. Akarguard protects the web tier; pair it with a hardened DNS provider to close the list.

---

Source: Akarguard Security Blog (https://akarguard.net/blog). Akarguard provides DDoS protection: traffic is proxied through our edge, attack traffic is filtered, and clean traffic reaches your origin. Reuse of this article with attribution and a link to the canonical URL is permitted.