Learn / Questions
A load balancer spreads traffic; it does not refuse any. Without a filter at the edge, every bot request is served like a user’s.
A load balancer’s job is to pick a healthy instance for each request. It does not know a scraper from a customer, so a flood of 20,000 requests a second on top of 1,500 real users is spread evenly over the API replicas and, through them, onto the database. The replicas run out of slots, the database pool fills, and the real users fail alongside the bots.
Defence is a question of where traffic is stopped, and how early. DDoS protection drops volumetric floods before they reach anything you pay for per request. A web application firewall and bot management reject requests that match attack signatures or behave like automation. A rate limiter caps what any one client can do. Each layer stops some share of the attack, and only what gets through all of them touches the application and the data layer.
Every filter has false positives, which is why the result reports how much of the attack was blocked and how many real requests were refused with it.
| Real users | 1,500 requests/s |
|---|---|
| Flood | 20,000 requests/s for 15 s |
| Stopped by a load balancer alone | 0% |
| Target | block ≥ 95% of the attack, keep the database out of it |
Put DDoS protection, a WAF and bot management in front of the load balancer, in that order, and rate-limit per client behind them, so the application only ever sees traffic that looks like users.
Opening and running a problem is free. Changes by command cost 1 credit each; you have 25 free credits a day.