What happens when the attack traffic looks identical to your real users?
L7 (application-layer) DDoS isn't about bandwidth — it's about expensive requests. Attackers craft floods that look like real HTTP traffic: valid TLS, valid headers, valid user-agents, hitting your /search or /cart endpoints. Each request is cheap to send but expensive to serve, and ten million per second will exhaust your origin's database, app server, or auth system long before your bandwidth is touched. Volumetric DDoS gets the headlines, but L7 attacks are the ones that quietly take production down.
How it fits together
Diagram coming soon
Architecture diagram for this solution will be added here.
How Cloudflare solves it
- Autonomous detection at the edge. Cloudflare's DDoS engine analyzes every request and identifies attack fingerprints — traffic shape, timing, request similarity — without you tuning anything. New attacks trigger mitigations automatically, often before your dashboards even spike.
- Adaptive DDoS mitigation. Profiles your normal traffic over time and detects deviations. An L7 flood of <code>POST /api/checkout</code> from new IPs gets challenged or blocked because it doesn't match your baseline — even if no static signature would catch it.
- Customizable response thresholds. Set sensitivity levels per zone or per ruleset. Action gradients: log → challenge → JS challenge → managed challenge → block. Combine with rate limiting and bot management for surgical defense.
- Unmetered & always-on. Cloudflare doesn't charge by attack size and never asks you to 'enable surge protection.' Mitigation is always on, included with every plan, even Free.
- HTTP/2 and HTTP/3 native. Detects and mitigates protocol-level attacks like HTTP/2 Rapid Reset (CVE-2023-44487) — Cloudflare disclosed and ships fixes for these classes of attack.
Common questions
What's the difference between L7 DDoS and the WAF?
Will I get false positives during legitimate traffic surges (a Black Friday spike)?
How do I know I'm under attack — and how do I know Cloudflare handled it?
What about Layer 3/4 (network-layer) DDoS?
Try it live
Demo coming soon
An interactive demo for Layer 7 DDoS Protection is being built. In the meantime, check the "Dive Deeper" section below for the official docs and product blogs.