Mitigation pipeline¶

Cheapest checks first; blocked traffic never reaches the expensive stages.

Stage	Where	What
Flowspec and RTBH	upstream routers	volumetric floods dropped before our edge, see Sites, pools and dedicated edges
XDP filter	edge network card	malformed packets, blocklists, traffic to unassigned addresses of our ranges, per-VIP port filter, per-source SYN rate limit, SYN cookies
Connection rate	TCP, before TLS	silent drop above `conn_drop_per_10s`
Country escalation	TCP, before TLS	under load, sources outside your country allowlist are rejected at connection setup
JA4 fingerprint	TLS handshake	fingerprint of the client stack, global blocklist
Protection rules	HTTP	your allow, skip, deny, challenge, block and drop rules, see Protection rules
Rate limits	HTTP	per source, per path, per fingerprint, and the aggregate limit per hostname and path
Slow-HTTP timeouts	HTTP	a request that never finishes is closed
Proof-of-work	HTTP	Argon2 challenge in the browser, no CAPTCHA
Edge cache	HTTP	cached responses served at the edge, WAF skipped on a hit
WAF	HTTP	Coraza with the OWASP Core Rule Set, request and response inspection
Origin		clean traffic forwarded, directly or through forward proxies