DDoS Protection, WAF and Bot Protection

Stopping fake traffic floods, hacking attempts (SQL injection, XSS) and bots at the edge, before they reach the website.

In a DDoS attack lakhs of infected machines (a botnet) send traffic at once. Without protection the site goes down in minutes.
A WAF blocks OWASP Top 10 attacks like SQL injection, XSS and path traversal at the request level.
Bots buy up ticket/flash-sale stock, scrape prices and do credential stuffing. Genuine users lose out.
Downtime = direct revenue loss and brand damage, which is why big sites keep always-on protection.
Compliance (such as PCI-DSS) expects web application protection.

Defense in depth: bot attack + DDoS on a flash sale

1.Attack traffic (500 Gbps UDP flood + bots + HTTP flood) -> Anycast edge: traffic is spread across many PoPs and scrubbed, and nothing reaches the origin
2.WAF: managed rules (OWASP CRS) + a rate-based rule (2000+ requests from one IP in 5 min = block) + SQL injection payloads blocked
3.Bot management: bot score, JS challenge / CAPTCHA (reCAPTCHA / hCaptcha / Turnstile) on suspicious traffic
4.The origin (ALB) accepts traffic only from CDN/WAF IP ranges, so a direct origin attack fails
5.Genuine users' checkout keeps working; rules are tuned later from the logs

Defense in depth: CDN -> WAF -> rate limit -> app

DDoS types: L3/L4 volumetric (UDP flood, SYN flood, amplification) and L7 (HTTP flood, requests that look genuine).
Anycast + scrubbing: attack traffic gets spread across many edge locations around the world and is filtered there, and clean traffic goes to the origin.
WAF rules: managed rule sets (OWASP Core Rule Set, AWS Managed Rules) + custom rules (country block, header check, rate rules).
Bot management: browser fingerprinting, behaviour analysis, JS challenge, bot score. Good bots (Googlebot) are allowed, bad ones blocked.
CAPTCHA / challenge: verify suspicious traffic with reCAPTCHA, hCaptcha or Cloudflare Turnstile.
Rate-based rules: more than 2000 requests from one IP in 5 minutes means block. Against L7 floods.
Origin protection: hide the origin's IP and allow only CDN/WAF IPs, otherwise the attacker will hit the origin directly.
Modes: test a rule first in 'count/log' mode, then 'block'. To avoid false positives.

Tool	Type	How it is used
Cloudflare	Edge DDoS + WAF + Bot Management	Unmetered DDoS protection (in all plans), managed WAF, Bot Management, Turnstile CAPTCHA.
AWS Shield	DDoS protection (AWS)	Shield Standard is free (L3/L4); Shield Advanced is paid: L7 help, 24x7 response team, cost protection.
AWS WAF	Web Application Firewall	Attached to CloudFront/ALB/API Gateway; managed rules, rate-based rules, Bot Control add-on.
Akamai (Prolexic, App & API Protector, Bot Manager)	Enterprise security suite	Large scrubbing capacity, common in banks and big e-commerce.
Google reCAPTCHA	Bot detection / CAPTCHA	v3 gives every request a score (0.0-1.0); extra verification or a block on a low score.
Azure DDoS Protection + Azure WAF	DDoS + WAF (Azure)	VNet-level DDoS protection; the WAF sits on Front Door or Application Gateway.
ModSecurity + OWASP CRS	Open-source WAF	Self-hosted WAF rules with Nginx/Apache.

Point	Cloudflare	AWS Shield + WAF	Akamai
Where it works	Its own anycast edge, in front of any origin	On AWS resources (CloudFront, ALB, API GW)	Its own global edge + scrubbing centers
DDoS (L3/L4)	Unmetered, in all plans	Shield Standard free, Advanced paid	Prolexic: very large scrubbing capacity
WAF	Managed rules, easy dashboard	Managed + custom rules, pay per rule/request	App & API Protector, managed tuning
Bot protection	Bot Management (Enterprise), Turnstile	AWS WAF Bot Control add-on	Bot Manager: advanced, expensive
Setup	DNS change, in minutes	AWS console/IaC, easy inside AWS	Enterprise onboarding, weeks
Cost	Starts with a free plan	Pay as you go; Shield Advanced ~3000 USD/month	Enterprise contract, the most expensive
Best for	Sites of every size, multi-cloud	AWS-only workloads	Big banks, OTT, e-commerce

Cloudflare: when you want quick and cheap all-in-one protection, with the origin anywhere.
AWS Shield + WAF: when the app is entirely on AWS and CloudFront/ALB is already in use.
Akamai: a very large enterprise, a regulated industry, when you need dedicated SOC support.
reCAPTCHA / Turnstile: to stop bots on forms like login, signup, OTP, checkout. Use it together with a WAF.
Self-hosted ModSecurity: an on-prem app where a cloud WAF cannot be used.

Scenario: bot attack + DDoS on a flash sale

A phone flash sale is at 12 PM; scalper bots start sending thousands of requests/second from 11:59.
Alongside, the attacker also launches a 500 Gbps UDP flood; the anycast edge spreads it across many PoPs and scrubs it. Nothing reaches the origin.
An HTTP flood at L7: a WAF rate-based rule (2000+ requests from one IP in 5 min) blocks those IPs.
Bot management computes a bot score for every request; anything with headless-browser-like patterns gets a JS challenge/CAPTCHA.
A SQL injection payload like ' OR 1=1 -- typed into the search box is blocked by the WAF managed rules.
The origin ALB takes traffic only from CDN/WAF IP ranges, so a direct origin attack fails.
Genuine users' checkout keeps working; the security team tunes the rules later by looking at the logs.

Explain the difference between L3/L4 and L7 DDoS, and say 'defense in depth: CDN -> WAF -> rate limit -> app'.
Mistake: putting the WAF straight into block mode. Genuine users can get blocked. Test in count/log mode first.
Mistake: leaving the origin IP public. The CDN/WAF gets bypassed. Allow only CDN IP ranges in the security group.
Mistake: relying only on CAPTCHA. CAPTCHA-solving services exist, so you need layered defense (rate limit + bot score + WAF).
Number: an example rate rule is 2000+ requests from one IP in 5 min = block; Shield Advanced is ~3000 USD/month.