What Is DDoS (Distributed Denial of Service)? - Security Glossary

How It Works

A DDoS attack overwhelms server resources by distributing the attack load across many sources simultaneously, making IP-level blocking ineffective.

Volumetric attack — The attacker commands a botnet of thousands of compromised devices (or rents one from an underground service for as little as $10/hour) to send UDP or ICMP packets to the target. The volume of traffic — potentially hundreds of gigabits per second — consumes all available bandwidth at the data center level, blocking all legitimate traffic before it reaches the server.

Protocol attack (SYN Flood) — The attacker sends TCP SYN packets (connection initiation) with spoofed source IP addresses. The server allocates a half-open connection entry in its state table for each SYN and sends SYN-ACK to the spoofed source — which never responds. The server's connection state table fills completely, preventing new legitimate connections.

Application Layer (L7) attack — The attacker sends valid-looking HTTP requests targeting computationally expensive operations in your Laravel application. A search endpoint that triggers a complex database query (/search?q=common_word), a report endpoint that generates large datasets, or a webhook endpoint that triggers job dispatching — each legitimate-looking request consumes significant CPU, database connections, and memory. Even 100-500 requests per second to the right endpoint can overwhelm a server that handles thousands of static requests per second.

Application-level mitigation — For L7 attacks, Laravel-level controls provide the most effective defense. Cache::remember() on expensive query results means repeat requests hit the cache (microseconds) rather than the database (hundreds of milliseconds). Dispatching heavy operations to queues (dispatch(new GenerateReport($data))) prevents HTTP workers from being blocked. Rate limiting catches automation patterns.

Infrastructure mitigation — Volumetric and protocol attacks require infrastructure-level mitigation: Cloudflare (free tier handles most attacks), AWS Shield (managed protection for AWS-hosted applications), or similar CDN/scrubbing services that absorb traffic before it reaches your origin.

Types of DDoS (Distributed Denial of Service)

Volumetric Attack

Floods bandwidth with UDP/ICMP traffic — measured in Gbps. Exhausts network capacity before traffic reaches the application server.

# Defense: infrastructure-level protection required
# Cloudflare free tier absorbs most volumetric attacks automatically
# No application code change can mitigate bandwidth exhaustion

Protocol Attack (SYN Flood)

Sends TCP SYN packets with spoofed source IPs to exhaust the server's connection state table, preventing new legitimate TCP connections from being established.

# Defense: configure SYN cookies at the OS level
# /etc/sysctl.conf:
# net.ipv4.tcp_syncookies = 1
# Also: Cloudflare and AWS Shield handle SYN floods automatically

Application Layer Attack (L7)

Sends valid HTTP requests targeting expensive application operations — search queries, report generation, API endpoints with complex DB queries. Requires fewer requests than volumetric attacks.

# Identifies expensive Laravel endpoints and floods them:
# GET /search?q=a (triggers full-text search without caching)
# POST /api/reports/generate (triggers heavy DB aggregation)
# Mitigated with Cache::remember() and queue dispatch

Amplification Attack

Attacker sends small requests (spoofing victim's IP) to open DNS/NTP resolvers, which send large responses to the victim — amplifying attack volume by 10-100x.

# DNS amplification: 60-byte query → 3000-byte response (50x amplification)
# Defense for your application: ensure your DNS resolvers are not open resolvers
# Use Cloudflare or authoritative-only DNS servers

In Laravel Applications

Laravel applications can mitigate DDoS at the infrastructure level with services like Cloudflare, AWS Shield, or similar CDN/DDoS protection services. At the application level, use rate limiting and caching to reduce server load during traffic spikes.

Code Examples

Expensive Endpoint Without vs. With Caching

Vulnerable

// VULNERABLE: Every request executes a heavy database query
// 500 requests/second from a DDoS = 500 concurrent DB queries
public function dashboard(): JsonResponse
{
    $stats = [
        'total_orders'   => Order::count(),
        'revenue_month'  => Order::whereMonth('created_at', now()->month)->sum('amount'),
        'top_products'   => Product::withCount('orders')->orderByDesc('orders_count')->take(10)->get(),
    ];
    return response()->json($stats);
}

Secure

// SECURE: Cache expensive results — DDoS hits cache, not the database
public function dashboard(): JsonResponse
{
    $stats = Cache::remember('dashboard_stats', now()->addMinutes(5), function () {
        return [
            'total_orders'  => Order::count(),
            'revenue_month' => Order::whereMonth('created_at', now()->month)->sum('amount'),
            'top_products'  => Product::withCount('orders')->orderByDesc('orders_count')->take(10)->get(),
        ];
    });
    return response()->json($stats);
}

// Also: dispatch heavy report generation to queues
public function generateReport(Request $request): JsonResponse
{
    dispatch(new GenerateReport($request->validated()));
    return response()->json(['message' => 'Report queued']);
}

Real-World Example

A DDoS attack sends 100,000 requests per second to your Laravel application, overwhelming your web server and making the site unavailable to real users.

Why It Matters

DDoS attacks against Laravel applications typically target the application layer (Layer 7) rather than the network layer, making them harder to distinguish from legitimate traffic. An attacker who knows your application can target expensive operations: complex search queries, PDF generation endpoints, or report endpoints that trigger large database queries. Even a modest number of requests to the right endpoint can overwhelm a server.

The primary mitigation for Laravel applications is infrastructure-level DDoS protection (Cloudflare, AWS Shield) combined with application-level rate limiting and caching. Cloudflare's free tier provides basic DDoS protection. For Laravel applications expecting growth or handling financial transactions, Cloudflare Pro or AWS Shield Standard are appropriate.

At the application level, caching expensive responses with Laravel's Cache facade reduces the work each request requires. Running php artisan config:cache, php artisan route:cache, and php artisan view:cache ensures Laravel's own bootstrap is not a bottleneck under load.

Queue-based architectures also help: operations that can be deferred (email sending, report generation, PDF creation) should be processed asynchronously via dispatch(new ProcessJob()) to a queue worker, preventing slow HTTP responses from consuming all server resources during spikes.

Common Misconceptions

Myth: DDoS attacks only happen to large, well-known sites.

Reality: Most DDoS attacks are opportunistic, for hire (booter/stresser services start at a few dollars), or targeted at small businesses by competitors or disgruntled users. Any public Laravel application is a potential target.

Myth: Rate limiting stops DDoS attacks.

Reality: Application-level rate limiting helps with low-volume targeted attacks but is overwhelmed by actual DDoS traffic before the limiting logic can even run. Infrastructure-level protection (Cloudflare, AWS Shield) is required for volumetric attacks.

Myth: A DDoS attack will always crash our server completely.

Reality: Partial degradation is more common — response times increase, some requests fail, but the server does not completely stop responding. This is harder to detect and diagnose. Monitoring response times alongside uptime is important.

How to Detect This

Monitor your application response times and request rates in real time using your hosting provider's metrics dashboard, Laravel Telescope (which tracks request duration and query count), or external uptime monitoring. A sudden spike in request volume or response time degradation without corresponding legitimate traffic growth is a DDoS indicator. Use `grep "yourdomain.com" /var/log/nginx/access.log | wc -l` to count requests per minute and compare against your baseline. StackShield monitors your application's response time and availability from external locations, alerting you when the site becomes slow or unavailable — which may indicate a DDoS attack or a configuration issue that has degraded performance.

How to Prevent This in Laravel

1
Enable Cloudflare (free tier) or AWS Shield in front of your application — volumetric DDoS attacks cannot be mitigated at the application level and require infrastructure-level absorption.
2
Use `Cache::remember()` on all computationally expensive controller methods to ensure repeated requests from an attack serve from cache rather than executing database queries.
3
Run `php artisan config:cache && php artisan route:cache && php artisan view:cache` on every deployment to minimize Laravel bootstrap time, reducing server load per request during traffic spikes.
4
Dispatch all slow operations (PDF generation, email sending, report aggregation) to queue workers with `dispatch(new Job($data))` to prevent HTTP workers from being occupied during traffic spikes.
5
Configure Nginx connection limits (`limit_conn_zone`, `limit_req_zone`) to control request rates at the web server layer before requests reach PHP-FPM.

Frequently Asked Questions

How does Cloudflare protect my Laravel application from DDoS?

Cloudflare sits between the internet and your origin server. All traffic routes through Cloudflare's network first. Cloudflare detects volumetric attacks (excess traffic from many IPs) and protocol attacks (malformed packets, SYN floods) using global traffic patterns and absorbs them at their edge — none of this traffic reaches your origin server. For L7 (application-layer) attacks, Cloudflare's WAF and rate limiting rules can block requests matching attack patterns, though L7 defense also benefits from application-level caching.

Does rate limiting stop DDoS attacks?

Application-level rate limiting (Laravel's `throttle` middleware) is ineffective against volumetric and protocol DDoS attacks because the server cannot process enough requests for the rate limiting middleware to even run — the attack volume exhausts OS-level resources before PHP processes start. Rate limiting does help against low-volume L7 attacks that target expensive application endpoints at sustained but modest request rates. For serious DDoS protection, infrastructure-level mitigation (Cloudflare, AWS Shield) is required.

How do I tell the difference between a DDoS attack and a legitimate traffic spike?

Check the request pattern in Nginx access logs or Cloudflare analytics: DDoS attacks typically show identical or highly similar User-Agents, requests from many different countries simultaneously, requests to a narrow set of endpoints, and no referrer. Legitimate spikes show diverse User-Agents and referrers, geographically consistent patterns, and spread across many application pages. A DDoS against a specific endpoint (`/search`) while other pages remain fast is a strong indicator of a targeted L7 attack.

What Laravel code changes reduce DDoS vulnerability?

Cache expensive query results with `Cache::remember()` — attacks targeting cached endpoints fail to degrade the database. Dispatch slow operations to queues with `dispatch()` to free HTTP workers quickly. Run all artisan cache commands (`config:cache`, `route:cache`, `view:cache`) in production to minimize bootstrap overhead. Add rate limiting to expensive endpoints like search and report generation. These measures reduce the blast radius of L7 attacks even when infrastructure-level mitigation is in place.

Related Terms

Rate Limiting

A technique that controls the number of requests a client can make to a server within a specified time period. Rate limiting protects against brute-force attacks, denial of service, API abuse, and web scraping by rejecting requests that exceed the defined threshold.

Brute-Force Attack

An attack method that tries every possible combination of credentials until the correct one is found. Brute-force attacks target login forms, API keys, encryption keys, and any authentication mechanism that does not limit the number of attempts.

Web Application Firewall (WAF)

A security tool that monitors and filters HTTP traffic between the internet and a web application. A WAF protects against common attacks like SQL injection, XSS, and request forgery by analyzing request patterns and blocking malicious traffic before it reaches your application.