DDoS Protection, WAFs and Rate Limiting

Attack types in plain terms

Volumetric — saturating your bandwidth with junk traffic. Mitigated upstream at the network edge, not on your server.
Protocol attacks — SYN floods and similar, exhausting connection tables.
Application layer (Layer 7) — floods of legitimate-looking HTTP requests to expensive pages such as search or checkout. Hardest to filter and most common against small sites.
Credential stuffing — automated login attempts using leaked password lists.
Scraper and spam bots — content theft, form spam and comment injection.

What the platform handles

Network-level DDoS mitigation, a managed firewall and ModSecurity rules operate before traffic reaches your account, and abusive IPs are throttled automatically. This covers volumetric and protocol attacks without any action from you.

What you should configure

Rate-limit login, registration, password reset and search endpoints.
Put a proxy or CDN with bot management in front of the site if you are frequently targeted.
Use CAPTCHA or a challenge on public forms, plus honeypot fields.
Block or throttle xmlrpc.php on WordPress unless you specifically need it.
Restrict admin areas by IP where staff work from fixed locations.
Cache aggressively — a fully cached page costs almost nothing to serve, which itself is DDoS resilience.

# .htaccess — restrict WordPress admin to known IPs
<Files wp-login.php>
  Require ip 203.0.113.25
  Require ip 198.51.100.0/24
</Files>

During an attack

1 Confirm it is an attack, not a legitimate traffic surge from a campaign or press mention.
2 Open a priority support ticket so upstream filtering can be tuned.
3 Enable a challenge mode at your CDN if you have one.
4 Temporarily disable the most expensive endpoints, such as on-site search.
5 Preserve logs — they are needed to build durable filtering rules afterwards.

Frequently asked questions

Is DDoS protection included?

Yes, network-level mitigation is part of the platform on shared, VPS and dedicated services.

Will a firewall slow my site down?

Negligibly. Filtering costs microseconds; the requests it blocks would have cost far more in PHP and database time.