Protection modes exist because there is no single correct answer to the question of how much to trust a visitor. Each step up the scale filters more automation and asks more of real people, and the right setting depends less on your threat level than on what the endpoint does.
The Modes
- Passthrough: traffic is proxied and rate limited, but no visitor is challenged. Lowest friction, and it still hides your origin address.
- JavaScript check: the client must execute a small script and return a cookie. Invisible to real browsers, fatal to most simple flood tools and scrapers.
- Wait screen: an explicit interstitial for a few seconds before the site loads. The strongest of the three, and the only one a visitor definitely notices.
The rule of thumb
Match the mode to the cost of being wrong. A public marketing page can afford to be generous; a login form or a search endpoint cannot.
What to Use Where
- Marketing pages and blogs: passthrough normally, so crawlers and social preview fetchers work without special cases.
- Login, registration, and password reset: a challenge, permanently. These endpoints are attacked continuously and are expensive per request.
- Search and filtering: a challenge, because these bypass caches and reach the database.
- APIs and webhooks: never a browser challenge. Automated clients cannot solve one. Protect these with keys and rate limits instead.
- During an active attack: raise the whole site a level, then lower it again once the attack ends.
The Mistake to Avoid
Turning on the strictest mode everywhere and leaving it there is the most common configuration error in DDoS protection. It breaks API clients, blocks search crawlers, and trains your users that the site is slow — all to defend against an attack that is not currently happening. Strong modes are an incident response tool; the steady state should be the weakest setting that keeps the origin healthy.
Verify After Every Change
After changing a mode, check three things: a normal page loads for a logged-out visitor, your API client still authenticates, and a search crawler fetch returns the page rather than the interstitial. A mode change that silently breaks an integration is usually discovered days later by someone whose job has nothing to do with security.