DDoS Stress Test

A DoS (Denial of Service) attack originates from a single source, overwhelming a target with traffic or requests. A DDoS (Distributed Denial of Service) attack uses many sources simultaneously — typically a botnet of thousands or millions of compromised devices — making it much harder to block because you cannot simply firewall a single IP. Modern attacks are almost always distributed. The Resilience Checker evaluates your defenses against both attack types.

Key defenses include: a CDN with built-in DDoS scrubbing (Cloudflare, AWS Shield, Akamai), rate limiting on all public HTTP endpoints, connection limits at the web server and load balancer level, anycast routing to absorb volumetric attacks across multiple PoPs, upstream bandwidth that exceeds likely attack volumes, and a DDoS response runbook so your team can activate defenses quickly. Even partial implementation of these controls significantly raises the cost of a successful attack.

Cloudflare provides strong DDoS protection in its free and paid tiers, but misconfiguration can undermine it. Common gaps include: origin IP exposure (attackers bypass Cloudflare by hitting your origin IP directly), Cloudflare set to 'Flexible' SSL or 'Development Mode', API endpoints not covered by Cloudflare proxying, and rate limiting rules not configured. The DoS Resilience Checker helps identify these gaps even when a CDN is present.

Yes. The resilience check is passive and non-intrusive — it does not send attack traffic, does not flood your server with requests, and does not cause any disruption. It analyzes publicly observable configuration signals: HTTP response headers, CDN fingerprints, rate limit responses to normal requests, and server behavior indicators. No production impact.