# Layer 7 DDoS Mitigation: A Practical Playbook > You cannot block your way out of an application-layer attack with an IP firewall. Here is the layered set of controls that actually mitigates Layer 7 DDoS, and the order to apply them. - Category: Best Practices - Author: Akarguard Team, Security Engineering - Published: Sep 13, 2026 - Canonical: https://akarguard.net/blog/layer-7-ddos-mitigation --- Mitigating a Layer 7 DDoS attack is different from stopping a volumetric flood. There is no single filter that separates good from bad, because every attack request is, by design, a valid request. Effective mitigation is a stack of controls, each of which raises the cost of an abusive request while leaving real users untouched. ## 1. Put a Reverse Proxy in Front of Your Origin The foundation. Route traffic through a reverse proxy via a DNS change so that no request reaches your server directly. This does two things: it gives you a place to inspect and filter traffic before it costs you anything, and it hides your origin IP so attackers cannot bypass every other control by hitting the server directly. If your origin IP is already public, change it after you move behind the proxy. ## 2. Challenge Suspicious Sessions A proof-of-browser challenge, a lightweight JavaScript or cookie test, is the single most effective L7 control. Real browsers solve it invisibly; commodity attack tools that do not run a full browser fail it and never reach your application. Reserve a harder CAPTCHA for higher-suspicion traffic, because it costs real users friction. ## 3. Rate-Limit Per Client Cap how fast and how many connections a single address can make. Two limits solve two problems: a request rate limit defends against fast floods, and a connection limit defends against slow attacks that hold sockets open without sending much. Set them above your busiest legitimate user and drop, rather than queue, once exceeded. ## 4. Run a WAF A Web Application Firewall scores requests against rules and blocks malformed or abusive patterns per endpoint. It catches the injection and probing traffic that often rides alongside a flood, and it lets you write endpoint-specific rules for the routes attackers favour. Keep a false-positive whitelist so a rule never blocks a legitimate integration. ## 5. Use Reputation Controls, Carefully When an attack is concentrated, blocking or challenging by country, ASN or IP range buys immediate relief. Use it as a temporary scalpel, not a permanent wall: geo-blocking a whole country also blocks that country's real users, so prefer an allow-list only when your audience is genuinely regional. ## 6. Ban Repeat Offenders Automatically Sources that keep breaching your limits should be dropped at the edge for a spell, with the ban doubling on repeat, so a persistent bot is removed from the equation before it costs you anything further. This keeps the expensive controls above free to focus on the traffic that is still ambiguous. > **Order matters** — Cheap filters first, expensive ones last: origin hidden, then challenge, then rate limits, then WAF scoring. By the time a request reaches your application it has already survived several checks. ## What Not to Do - Do not rely on an IP blocklist alone: attackers rotate IPs faster than you can list them. - Do not CAPTCHA everyone: you will lose real users and conversions. - Do not forget your integrations: payment callbacks, webhooks and non-browser API clients must be allow-listed or they break under a challenge. - Do not leave your origin IP exposed: it undoes every other control. Akarguard applies this stack on its reverse-proxy edge, with the challenge modes, rate limits, WAF, reputation lists and automatic banning all controllable per domain from the panel. For how the attacks themselves work and the types you will meet, see our [guide to Layer 7 DDoS attacks](https://akarguard.net/blog/layer7-ddos-attacks). --- Source: Akarguard Security Blog (https://akarguard.net/blog). Akarguard provides DDoS protection: traffic is proxied through our edge, attack traffic is filtered, and clean traffic reaches your origin. Reuse of this article with attribution and a link to the canonical URL is permitted.