Mitigation pipeline¶

Cheapest checks first; blocked traffic never reaches the expensive stages.

Stage	Where	What
Flowspec	upstream routers	volumetric floods dropped before our edge
XDP filter	edge NIC	malformed packets, blocklists, per-VIP port filter, per-source SYN rate limit
Connection rate	TCP, before TLS	silent drop above `conn_drop_per_10s`
JA4 fingerprint	TLS handshake	fingerprint of the client stack; global blocklist
Protection rules	HTTP	your allow, deny, challenge and rate rules on geo, IP, ASN, JA4, path
Connection and request rate	HTTP	`429` above `conn_per_10s`, `req_per_10s`, per-path and per-JA4 limits
Slow-HTTP detection	HTTP	byte-rate check, challenge or drop
Proof-of-work	HTTP	Argon2 challenge in the browser, no CAPTCHA
Edge cache	HTTP	cached responses served at the edge, WAF skipped on hit
WAF	HTTP	Coraza with OWASP Core Rule Set, request and response inspection
Origin		clean traffic forwarded, directly or through forward proxies