DDoS Protection
Definition
DDoS protection covers everything a host does to absorb or discard hostile traffic before it reaches whatever is being defended. Attacks fall into two rough families. Volumetric floods work at the network layer — SYN floods, or UDP amplification bounced off open DNS and NTP resolvers — and are measured in gigabits per second; several hundred Gbps is unremarkable now, and the largest recorded events have passed a terabit. Application-layer floods are quieter: ordinary-looking HTTP requests aimed at an expensive path, counted in requests per second rather than bits, where a few thousand per second can stall one small server. Protection is a property of the network a file sits behind rather than a switch you flip for a single upload, which is why it usually arrives as part of a CDN or an edge network rather than as a product of its own.
Why It Matters
For static files the risk is rarely lost data — it is being unreachable at the worst possible moment, and the bill that follows. A 20 MB video served 50,000 times in an hour is a terabyte of transfer, and on a metered plan that is a genuine invoice for traffic no human watched. A lone origin server saturates its uplink long before that, and then every visitor gets a timeout whether they are part of the flood or not. Put a distributed network in front and the same flood is split across dozens of locations and answered from cache, so the origin never notices. The difference between those outcomes is usually not hardware but where the traffic terminates.
How It Works
Most protection starts with anycast: one IP address is announced from many locations, so a flood aimed at that address is divided among whichever sites are nearest each attacking machine. At the packet level, filters drop malformed traffic, SYN cookies let a server complete handshakes without holding state for each one, and anything matching a known amplification signature is discarded on sight. Above that sits rate limiting, which counts requests per IP address in a rolling window and answers anything over the threshold with HTTP 429 Too Many Requests. Traffic that looks suspicious but not certainly hostile gets a challenge instead of a block — a short computation or a managed check that a scripted client tends to fail. Real visitors are served from cache throughout, which is the quiet advantage of static content: sending a cached file again costs the edge almost nothing.
Real-World Example
A conference publishes its schedule as a static site at summit-2026.99helpers.site, and on the morning of the event the link reaches the front page of a large forum. Views go from a few hundred an hour to eighty thousand in ten minutes, while a scraper hammers the programme PDF on the side. Because 99helpers serves those files from an edge network rather than one machine, the burst is answered from cache in dozens of places and the schedule stays up. The organiser sees a tall spike in the analytics and nothing else to do about it.
Common Mistakes
- ✕Assuming a small site is not a target — most floods are opportunistic and pick addresses, not brands
- ✕Trying to block your way out with a list of bad IP addresses — a distributed attack has thousands of sources and rotates them
- ✕Treating an expensive dynamic endpoint as protected because the rest of the site is cached — the flood will find the one path that is not
Related Terms
Web Application Firewall
A filter that reads each incoming HTTP request and blocks the ones matching known attack patterns. Unlike a network firewall, it looks at what a request says, not merely where it came from.
Bot Traffic
Requests made by software rather than a person — search crawlers, link previewers, monitors, scrapers and scanners. On a typical public address a large share of raw hits are never human.
IP Address
The number that identifies a machine on the internet, so packets know where to go. Every request a visitor makes carries the address it came from, which is why addresses turn up in logs, analytics and privacy law.
CDN
A content delivery network: a set of servers spread across the world that keep copies of your files and answer each visitor from somewhere close to them. It is the service; the machines it runs on are its edge network.
Edge Network
The fleet of servers a delivery provider runs in cities around the world, positioned close to visitors rather than close to your origin. It is the machinery a CDN is built from.
Put a file online in seconds
Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.
Host a file free →