Layered DDoS defence, so one attack is one site's problem

Three layers, because one is never enough

A volumetric flood, an L7 application flood and a slow connection-exhaustion attack are three different problems. We handle each of them where it is cheapest and fastest to handle — upstream of the fleet, at the edge, and inside the cage.

Containment is the point

Most hosting outages during an attack are not caused by the attack reaching its target. They are caused by the target's resource consumption starving everything else on the box. That is the failure mode this architecture is designed to remove.

• Every site runs inside its own CloudLinux LVE resource cage — the attacked site is throttled at its own ceiling, and neighbouring sites keep the resources their own limits guarantee them.
• CageFS gives each tenant an isolated filesystem view, so an attack that escalates into an intrusion attempt is contained rather than shared across tenants.
• CloudLinux MySQL Governor throttles database usage per site, so an application-layer flood that hammers uncached queries cannot drag the database down for everyone else on the server.
• Per-site LiteSpeed LSAPI workers are bounded by that site's LVE limits, so a flood cannot spawn unbounded PHP processes.
• Per-IP connection limits and LiteSpeed connection throttling absorb slow-connection and connection-exhaustion attacks at the web server, not at the application.

Signal to action, automatically

Mitigation is not a support ticket. Signals feed a policy engine that maps each one to an enforcement action, a customer notification and — where possible — an automatic remediation, with every transition logged.

What is included, and what you buy when risk goes up

Baseline protection is not optional, because an attacked or compromised site threatens its neighbours, our server reputation and our IP ranges. Heavier protection exists for sites whose risk profile calls for it.

• Included on every plan: LVE and CageFS isolation, LiteSpeed connection and request throttling, the Imunify360 network firewall with brute-force protection and IP reputation filtering, the proactive WAF, and real-time malware scanning.
• Available as add-ons: advanced bot management, higher DDoS protection tiers, enhanced WAF rules, priority scanning and dedicated firewall rules.
• Also upsold when you need it: one-click malware cleanup and remediation, for the case where an attack was the cover for a compromise rather than the goal.
• Advanced network-layer mitigation via Cloudflare Magic Transit or Spectrum is available for enterprise and high-risk workloads.

Attacks that are really something else

A traffic spike is often a symptom. The same signal pipeline that handles floods also catches the compromises that produce them, so an incident gets classified correctly rather than just absorbed.

• Imunify360 scans in real time and the proactive WAF blocks known exploit techniques before a patch exists for the underlying vulnerability — the route by which a site becomes someone else's attack tool.
• Outbound mail is rate-limited per site and watched for volume spikes, bounce rates, blocklist hits and complaint signals, so a compromised site sending spam is caught in minutes rather than after a blocklisting.
• Suspected malware and phishing are cross-checked against Google Safe Browsing, PhishTank and SURBL/APWG, and correlated with scan results before an enforcement decision is taken.
• Resource abuse and crypto-miners surface as LVE CPU and IO faults logged per site, which auto-throttle the offender.
• Every signal lands in one Abuse Desk in the admin console — aggregated, deduplicated and prioritised — rather than in four disconnected tools.

Related

• Security & isolation →
• CDN & Cloudflare pool →
• Caching & performance →
• Backups & restores →
• Footprint-free hosting →