Mitigating a Layer 7 DDoS attack is different from stopping a volumetric flood. There is no single filter that separates good from bad, because every attack request is, by design, a valid request. Effective mitigation is a stack of controls, each of which raises the cost of an abusive request while leaving real users untouched.
1. Put a Reverse Proxy in Front of Your Origin
The foundation. Route traffic through a reverse proxy via a DNS change so that no request reaches your server directly. This does two things: it gives you a place to inspect and filter traffic before it costs you anything, and it hides your origin IP so attackers cannot bypass every other control by hitting the server directly. If your origin IP is already public, change it after you move behind the proxy.
2. Challenge Suspicious Sessions
A proof-of-browser challenge, a lightweight JavaScript or cookie test, is the single most effective L7 control. Real browsers solve it invisibly; commodity attack tools that do not run a full browser fail it and never reach your application. Reserve a harder CAPTCHA for higher-suspicion traffic, because it costs real users friction.
3. Rate-Limit Per Client
Cap how fast and how many connections a single address can make. Two limits solve two problems: a request rate limit defends against fast floods, and a connection limit defends against slow attacks that hold sockets open without sending much. Set them above your busiest legitimate user and drop, rather than queue, once exceeded.
4. Run a WAF
A Web Application Firewall scores requests against rules and blocks malformed or abusive patterns per endpoint. It catches the injection and probing traffic that often rides alongside a flood, and it lets you write endpoint-specific rules for the routes attackers favour. Keep a false-positive whitelist so a rule never blocks a legitimate integration.
5. Use Reputation Controls, Carefully
When an attack is concentrated, blocking or challenging by country, ASN or IP range buys immediate relief. Use it as a temporary scalpel, not a permanent wall: geo-blocking a whole country also blocks that country's real users, so prefer an allow-list only when your audience is genuinely regional.
6. Ban Repeat Offenders Automatically
Sources that keep breaching your limits should be dropped at the edge for a spell, with the ban doubling on repeat, so a persistent bot is removed from the equation before it costs you anything further. This keeps the expensive controls above free to focus on the traffic that is still ambiguous.
Order matters
Cheap filters first, expensive ones last: origin hidden, then challenge, then rate limits, then WAF scoring. By the time a request reaches your application it has already survived several checks.
What Not to Do
- Do not rely on an IP blocklist alone: attackers rotate IPs faster than you can list them.
- Do not CAPTCHA everyone: you will lose real users and conversions.
- Do not forget your integrations: payment callbacks, webhooks and non-browser API clients must be allow-listed or they break under a challenge.
- Do not leave your origin IP exposed: it undoes every other control.
Akarguard applies this stack on its reverse-proxy edge, with the challenge modes, rate limits, WAF, reputation lists and automatic banning all controllable per domain from the panel. For how the attacks themselves work and the types you will meet, see our guide to Layer 7 DDoS attacks.