Most people picture a DDoS attack as a tidal wave of traffic: gigabits per second crashing against a server. Layer 7 (application-layer) attacks are nothing like that. They look, at first glance, like normal users, and that is exactly what makes them hard to stop.
This guide covers what makes an attack Layer 7, the main attack types and the signal that gives each one away, why they slip past network firewalls, and the controls that stop them, including how Akarguard handles them on its reverse-proxy edge.
What Makes a DDoS Attack "Layer 7"
Layer 7 is the application layer of the OSI model, where HTTP, HTTPS, DNS and API traffic live (if you want the networking background first, read what Layer 7 is). A Layer 7 DDoS attack targets this layer with requests that are individually valid but collectively designed to overwhelm the work your application has to do to answer them.
That is the core difference from a volumetric attack. A network-layer flood tries to saturate your pipe. An application-layer flood tries to saturate your CPU, your database and your worker threads with requests that each look legitimate.
Layer 7 vs L3/L4 Attacks: The Key Difference
A volumetric (L3/L4) attack tries to exhaust your bandwidth or connection-state tables with raw packet volume: SYN floods, UDP floods, amplification. An L7 attack sends complete, valid HTTP requests with proper TLS handshakes, real-looking headers and plausible user agents, but points them at endpoints that are expensive to serve: search pages, login forms, checkout APIs, and any database-backed route. Our field guide to volumetric, protocol and application attacks puts the three classes side by side.
Why it matters
A 50k requests-per-second L7 flood can take down a site that would shrug off a much larger packet flood, because each request forces real work: a database query, a template render, a cache miss.
Types of Layer 7 DDoS Attacks
Layer 7 is not one attack but a family of methods. They all send valid HTTP requests, but they differ in how they turn that validity into pressure on your servers, and each leaves a different signal. Knowing the type tells you which control to reach for.
HTTP Flood
The most common L7 attack. A botnet sends a high rate of GET or POST requests, usually aimed at endpoints that are expensive to serve: search, filtering, login, checkout, or any route backed by a database. Because each request is well formed, a network firewall lets it through; only the rate and the concentration on one route give it away.
Slowloris and Slow POST
The opposite of a flood. Instead of many fast requests, the attacker opens many connections and sends the request headers or body as slowly as possible, one byte at a time, to keep threads occupied. It costs almost no bandwidth and can take down a thread-per-connection server from a single machine. The signal is many long-lived, barely-progressing connections. How Slowloris takes down an Apache server walks through it step by step.
Cache-Busting
A CDN protects your origin by serving cached copies. Cache-busting defeats that by appending a unique query string to every request, so nothing matches the cache and every request is forced through to the origin. The tell is a flood of requests to the same path with random or incrementing query parameters.
Credential-Stuffing Floods
Attackers replay large lists of breached usernames and passwords against a login endpoint. It is both an account-takeover attempt and a denial-of-service load, because authentication is one of the most expensive things a web app does. A spike in POSTs to the login route with a high failure rate is the classic pattern; see stopping credential stuffing at the edge.
API and GraphQL Abuse
Modern apps expose rich APIs. A single crafted GraphQL query can request deeply nested relations that cost the server enormously to resolve. Attackers exploit this asymmetry, sending small queries that each trigger heavy work. Rate limits alone are not enough here; query cost analysis matters. More in API security and DDoS.
HTTP/2 Rapid Reset (CVE-2023-44487)
Disclosed in late 2023, Rapid Reset abuses HTTP/2 stream multiplexing: the attacker opens a request stream and immediately cancels it, then repeats, forcing the server to set up and tear down work at a rate far higher than the connection count suggests. It drove several record-breaking floods and prompted urgent patches across web servers and proxies. The full Rapid Reset story.
Common thread
Every L7 type exploits the same asymmetry: a request that is cheap to send but expensive to serve. Defence means detecting the pattern and making the abusive request pay its own cost.
Why Layer 7 Attacks Are Hard to Detect
Each individual request in an L7 attack is technically valid. A firewall that only inspects IP and port headers passes every one of them. Detection has to happen at the behavior level: how fast is this client sending requests, does its request pattern match a real user journey, is the traffic mix for this endpoint suddenly abnormal?
Key signal
Real users have natural variance in their timing and navigation. Automated traffic does not. Even well-built attack tools leave statistical fingerprints, and the ratio of filtered to clean traffic on a single endpoint is often the first thing to spike.
How to Stop a Layer 7 DDoS Attack
There is no single switch. Effective L7 mitigation layers several controls so that a request has to pass all of them before it reaches your origin, and each attack type is beaten by a different one:
- Fast floods (HTTP flood, cache-busting): a proof-of-browser challenge that real browsers solve invisibly and simple bots fail, plus per-IP request rate limits. Read CAPTCHA vs JavaScript challenge before you pick one.
- Slow attacks (Slowloris, slow POST): per-IP connection limits and short client timeouts.
- Credential stuffing: tight rate limits on the login route, plus a challenge or CAPTCHA on repeated failures.
- API and GraphQL abuse: query cost limits and endpoint-specific rate rules.
- Rapid Reset: keep your server and proxy patched; a maintained edge handles this for you.
- All of them: a web application firewall to score abusive request patterns, automatic banning of repeat offenders, and your origin IP hidden behind the proxy so none of this can be bypassed.
The goal is not to block traffic, it is to make legitimate requests cheap and abusive ones expensive, so the attack exhausts itself instead of your servers. The Layer 7 DDoS mitigation playbook gives the controls in the order to deploy them, and rate limiting strategies covers how to set limits without hurting real users.
How Akarguard Handles Layer 7
Akarguard sits in front of your origin as a reverse proxy: you point your DNS at the edge, and every request is inspected before it is allowed through. We are honest about what runs today — a real, working reverse-proxy edge, not a marketing claim about proprietary AI:
- Protection modes you control per domain, from a transparent cookie check up to a full JavaScript challenge or CAPTCHA, so you can dial defence up during an attack and back down after.
- A Naxsi-based WAF you manage from the panel: scoring, per-category rules, false-positive whitelisting and a live detections view.
- Per-domain rate and connection limits, with automatic edge banning of sources that keep exceeding them.
- Country, ASN and IP block and allow lists, applied at the edge within seconds.
- A search-engine bot allow-list, so mitigation never blocks Googlebot and friends.
- Origin IP protection: once traffic flows through the edge, the origin address stays off the public record.
How to Test Your Site for Layer 7 Resilience
The only safe way to find out how your defences hold up is to test infrastructure you own, with permission, using a controlled load tool, and never against a third party. Ramp request rate against an expensive endpoint, watch where latency and error rate climb, and confirm that your challenge and rate-limit rules engage before the origin degrades. Testing anything you do not own is illegal in most jurisdictions. Our guide to testing your site against Layer 7 DDoS covers tools, staging and how to read the results.
Layer 7 attacks are getting more common precisely because they are cheap to launch and hard to filter. The defence is not one clever trick but a stack of controls that each raise the cost of an abusive request while leaving real users untouched.