Protect your web applications against DDoS attacks and understand mitigation metrics and sensitivity settings.
DDoS Mitigation helps protect your web applications from Distributed Denial of Service (DDoS) attacks at the edge. Bunny Shield uses stateful request validation, behavioral analysis, and JavaScript Proof-of-Work (PoW) challenges to respond to suspicious traffic.A JavaScript PoW challenge asks the browser to complete a computational task. This helps validate the client, but adds an extra step for challenged users.
Use the DDoS page in your Shield zone to review aggregate mitigation metrics, including challenges and blocked sources.DDoS mitigation does not produce per-request entries in Shield Event Logs. The event logging API does not provide per-request DDoS records either.
A blocked source represents a source of traffic identified by Shield, such as an IP address, a JA4 fingerprint, or a combination of request characteristics. The metric counts blocked sources rather than individual requests.Source blocking can be triggered by different layers of Shield, including the WAF. You may therefore see blocked sources even when no DDoS challenges are shown, as other Shield protections can detect and block the traffic.
For activity recorded by other Shield features, such as the WAF, use Shield Event Logs. Grouping by source IP can help you investigate related events, where available.These events can provide context, but they are not a complete record of DDoS mitigation and may not explain every blocked source.
DDoS sensitivity controls how aggressively Shield responds to suspicious traffic. Higher sensitivity makes mitigation more aggressive and can result in more clients being challenged, including legitimate users.Choose a level based on your application’s normal traffic and current conditions:
If suspected attack traffic continues to affect your application, consider increasing sensitivity and monitoring the result.
After each change, check that legitimate users and expected clients can still access your application.
A high blocked source count on its own is not a reason to increase sensitivity. Consider the impact on your application and the activity recorded by other Shield protections.
