--- title: "DDoS Defense at the API Gateway: Layered Controls and Failure Planning - API7.ai" description: "Place API gateway controls in a layered DDoS defense with upstream mitigation, origin protection, resource limits, observability, and response drills." url: "https://api7.ai/learning-center/api-gateway-guide/api-gateway-ddos-defense" --- [Skip to article](#column-content) Column contentsAPI Gateway Guide [API Gateway Guide](https://api7.ai/learning-center/api-gateway-guide) Search this column 01 Gateway Fundamentals [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=fundamentals)[1. What Is an API Gateway? API Gateway Software and Use Cases](https://api7.ai/learning-center/api-gateway-guide/what-is-an-api-gateway)[2. Why Do Modern Architectures Need an API Gateway?](https://api7.ai/learning-center/api-gateway-guide/why-do-modern-architectures-need-api-gateway)[3. Reverse Proxy vs Load Balancer vs API Gateway](https://api7.ai/learning-center/api-gateway-guide/api-gateway-vs-reverse-proxy-vs-load-balancer)[4. API Gateway and Microservices: Decoupling and Traffic Management](https://api7.ai/learning-center/api-gateway-guide/api-gateway-and-microservices)[5. Understanding Core API Gateway Features](https://api7.ai/learning-center/api-gateway-guide/core-api-gateway-features)[6. Open Source vs. Commercial API Gateways: How to Choose the Right One?](https://api7.ai/learning-center/api-gateway-guide/open-source-vs-commercial-api-gateway)[7. API Gateway vs Service Mesh: How to Choose?](https://api7.ai/learning-center/api-gateway-guide/api-gateway-vs-service-mesh)[8. Envoy vs NGINX, Java, and Go for API Gateways](https://api7.ai/learning-center/api-gateway-guide/nginx-vs-envoy-vs-java-vs-go)[9. Core Concepts of API Gateway: Service, Route, Upstream, Plugin, and Consumer](https://api7.ai/learning-center/api-gateway-guide/core-concepts-of-api-gateway)[10. API Gateway Comparison: Apache APISIX vs. Kong vs. Traefik vs. KrakenD vs. Tyk](https://api7.ai/learning-center/api-gateway-guide/api-gateway-comparison-apisix-kong-traefik-krakend-tyk) 02 Gateway Architecture and Design [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=architecture)[11. Deep Dive into API Gateway Architecture: Core Components and Design Principles](https://api7.ai/learning-center/api-gateway-guide/api-gateway-architecture)[12. Choosing the Right API Gateway for Your Architecture](https://api7.ai/learning-center/api-gateway-guide/api-gateway-monolithic-vs-microservices)[13. How to Architect an API Gateway for High Availability (HA)?](https://api7.ai/learning-center/api-gateway-guide/api-gateway-high-availability)[14. API Gateway Plugin Architecture: How to Extend and Customize Your API Gateway](https://api7.ai/learning-center/api-gateway-guide/api-gateway-plugin-system)[15. How Event-Driven Architecture (EDA) Works with API Gateway?](https://api7.ai/learning-center/api-gateway-guide/api-gateway-event-driven-architecture)[16. API Gateway Request Lifecycle Explained](https://api7.ai/learning-center/api-gateway-guide/api-gateway-request-lifecycle-explained)[17. Cloud-Native API Gateway on Kubernetes](https://api7.ai/learning-center/api-gateway-guide/cloud-native-api-gateway-kubernetes)[18. API Gateway Control Plane vs. Data Plane](https://api7.ai/learning-center/api-gateway-guide/api-gateway-control-plane-vs-data-plane)[19. How API Gateways Work with GitOps: Automating API Management](https://api7.ai/learning-center/api-gateway-guide/api-gateway-gitops-integration)[20. How to Perform A/B Testing and Canary Releases with an API Gateway](https://api7.ai/learning-center/api-gateway-guide/ab-testing-canary-release-api-gateway) 03 Gateway Setup and Traffic Handling [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=traffic-protocols)[21. How to Deploy an API Gateway on Kubernetes: Step-by-Step Guide for Engineers](https://api7.ai/learning-center/api-gateway-guide/deploy-api-gateway-on-kubernetes)[22. Hands-on Setup with Apache APISIX API Gateway](https://api7.ai/learning-center/api-gateway-guide/api-gateway-getting-started-guide)[23. API Gateway Auth: OAuth 2.0, JWT & OIDC with APISIX](https://api7.ai/learning-center/api-gateway-guide/api-gateway-authentication-apache-apisix-oauth-jwt-oidc)[24. Mastering Traffic Control: Efficiently Managing API Requests with Gateways](https://api7.ai/learning-center/api-gateway-guide/api-gateway-traffic-control-strategies)[25. Building Reliable API Gateways with Logging and Monitoring](https://api7.ai/learning-center/api-gateway-guide/api-gateway-logging-monitoring-best-practices)[26. Dynamic Routing in API Gateways: Best Practices for Flexible Traffic Management](https://api7.ai/learning-center/api-gateway-guide/api-gateway-dynamic-routing-management)[27. How API Gateways Support WebSocket](https://api7.ai/learning-center/api-gateway-guide/how-api-gateways-support-websocket)[28. API Gateway for GraphQL: Security, Cost, and Caching](https://api7.ai/learning-center/api-gateway-guide/api-gateway-handle-graphql)[29. How API Gateways Handle HTTP/3 QUIC Requests](https://api7.ai/learning-center/api-gateway-guide/api-gateway-http3-quic)[30. How API Gateways Handle MQTT Requests](https://api7.ai/learning-center/api-gateway-guide/api-gateway-mqtt) 04 Gateway Integrations, AI, and MCP [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=ai-mcp)[31. How API Gateways Handle gRPC Requests](https://api7.ai/learning-center/api-gateway-guide/api-gateway-grpc-support)[32. How API Gateways Implement Custom Plugins](https://api7.ai/learning-center/api-gateway-guide/api-gateway-custom-plugins)[33. How API Gateways Integrate with Kafka](https://api7.ai/learning-center/api-gateway-guide/api-gateway-kafka-integration)[34. How to Implement API Aggregation in API Gateways](https://api7.ai/learning-center/api-gateway-guide/api-gateway-api-aggregation)[35. How API Gateways Enable Serverless Architecture](https://api7.ai/learning-center/api-gateway-guide/api-gateway-serverless-architecture)[36. How API Gateways Proxy LLM Requests](https://api7.ai/learning-center/api-gateway-guide/api-gateway-proxy-llm-requests)[37. How API Gateways Enhance MCP Servers](https://api7.ai/learning-center/api-gateway-guide/api-gateway-enhance-mcp-server)[38. MCP Gateway vs MCP Proxy vs AI Gateway vs API Gateway](https://api7.ai/learning-center/api-gateway-guide/ai-gateway-vs-mcp-gateway-vs-api-gateway)[39. What Is an AI Gateway? Architecture and Benefits](https://api7.ai/learning-center/api-gateway-guide/what-is-an-ai-gateway)[40. What Is an MCP Gateway? Architecture, Use Cases & How It Works (2026 Guide)](https://api7.ai/learning-center/api-gateway-guide/what-is-mcp-gateway) 05 Gateway Performance [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=performance)[41. How API Gateway Reduces Latency: Performance Optimization Strategies](https://api7.ai/learning-center/api-gateway-guide/how-api-gateway-reduces-latency)[42. API Gateway Caching Strategy: Comprehensive Analysis and Implementation Guide](https://api7.ai/learning-center/api-gateway-guide/api-gateway-caching-strategy-analysis)[43. How to Optimize API Gateway Load Balancing: Advanced Strategies and Best Practices](https://api7.ai/learning-center/api-gateway-guide/how-to-optimize-api-gateway-load-balancing)[44. How API Gateway Efficiently Handles Large-Scale Traffic: Architecture and Strategies](https://api7.ai/learning-center/api-gateway-guide/how-api-gateway-handles-large-scale-traffic)[45. How to Improve API Gateway QoS: Traffic Classes, Capacity Protection, and SLOs](https://api7.ai/learning-center/api-gateway-guide/api-gateway-quality-of-service)[46. API Gateway Log Storage: Pipelines, Retention, Security, and Cost](https://api7.ai/learning-center/api-gateway-guide/api-gateway-log-storage)[47. API Gateway Timeouts and Retries: Safe Policies and APISIX Configuration](https://api7.ai/learning-center/api-gateway-guide/api-gateway-timeouts-retries)[48. API Gateway Concurrency Control: Capacity Budgets, Backpressure, and Load Shedding](https://api7.ai/learning-center/api-gateway-guide/api-gateway-concurrency-control)[49. Asynchronous API Gateway Patterns: Queues, Callbacks, and Performance Boundaries](https://api7.ai/learning-center/api-gateway-guide/asynchronous-api-gateway-patterns)[50. API Gateway TLS Performance: Handshakes, Session Reuse, and Measurement](https://api7.ai/learning-center/api-gateway-guide/api-gateway-tls-performance) 06 Gateway Security [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=security)[51. DDoS Defense at the API Gateway: Layered Controls and Failure Planning](https://api7.ai/learning-center/api-gateway-guide/api-gateway-ddos-defense)[52. Distributed API Gateway Rate Limiting: Local vs Redis Counters and Accuracy Trade-offs](https://api7.ai/learning-center/api-gateway-guide/distributed-api-gateway-rate-limiting)[53. API Gateway IP Allowlist and Denylist Management: Trust, Proxies, and Operations](https://api7.ai/learning-center/api-gateway-guide/api-gateway-ip-allowlist-denylist-management)[54. API Gateway Security Scanning: What to Test and How to Operationalize Findings](https://api7.ai/learning-center/api-gateway-guide/api-gateway-security-scanning)[55. SQL Injection and XSS at the API Gateway: Detection Limits and Defense in Depth](https://api7.ai/learning-center/api-gateway-guide/sql-injection-xss-api-gateway)[56. API Access Log Auditing: Evidence, Integrity, Retention, and Review](https://api7.ai/learning-center/api-gateway-guide/api-access-log-auditing)[57. Preventing API Scraping and Abuse: Identity, Behavioral Signals, and Rate Controls](https://api7.ai/learning-center/api-gateway-guide/prevent-api-scraping-abuse)[58. API Gateway mTLS: Client Identity, Certificate Rotation, and APISIX Configuration](https://api7.ai/learning-center/api-gateway-guide/api-gateway-mtls)[59. Fine-Grained API Gateway Authorization: RBAC, ABAC, and External Policy Decisions](https://api7.ai/learning-center/api-gateway-guide/fine-grained-api-gateway-authorization)[60. API Gateway and WAF Reference Architecture: Ownership, Header Trust, and Failure Modes](https://api7.ai/learning-center/api-gateway-guide/api-gateway-waf-reference-architecture) 07 Gateway Ecosystem and Comparisons [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=ecosystem)[61. Apache APISIX vs Kong: Migration, Operations, and Team Fit](https://api7.ai/learning-center/api-gateway-guide/apache-apisix-vs-kong)[62. Traefik vs Kong vs APISIX: A Reproducible API Gateway Benchmark Method](https://api7.ai/learning-center/api-gateway-guide/traefik-kong-apisix-benchmark-method)[63. Amazon API Gateway Explained: Deployment Models, Trade-offs, and Use Cases](https://api7.ai/learning-center/api-gateway-guide/amazon-api-gateway-explained)[64. API Gateway and Istio: Clear North-South and East-West Boundaries](https://api7.ai/learning-center/api-gateway-guide/api-gateway-istio)[65. API Gateway with NGINX: Layering, Ownership, and Migration Patterns](https://api7.ai/learning-center/api-gateway-guide/api-gateway-nginx)[66. API Gateway with Envoy: Deployment Patterns and Policy Ownership](https://api7.ai/learning-center/api-gateway-guide/api-gateway-envoy)[67. API Gateway with Cloudflare API Shield: Edge and Origin Security Boundaries](https://api7.ai/learning-center/api-gateway-guide/api-gateway-cloudflare-api-shield)[68. Apigee vs MuleSoft vs Amazon API Gateway: A Decision Framework](https://api7.ai/learning-center/api-gateway-guide/apigee-mulesoft-amazon-api-gateway)[69. Should an API Gateway Connect Directly to a Database? Patterns and Risks](https://api7.ai/learning-center/api-gateway-guide/api-gateway-database-access-patterns)[70. API Gateway Architecture for Large-Scale SaaS Platforms](https://api7.ai/learning-center/api-gateway-guide/api-gateway-large-scale-saas-architecture) 08 Industry Applications and Integrations [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=applications)[71. API Gateway CI/CD: Validation, Promotion, and Safe Rollback](https://api7.ai/learning-center/api-gateway-guide/api-gateway-ci-cd)[72. API Gateways for AI and ML Inference: Traffic, Security, and Observability](https://api7.ai/learning-center/api-gateway-guide/api-gateways-ai-ml-inference)[73. API Gateway Architecture for Financial Services: Controls and Failure Boundaries](https://api7.ai/learning-center/api-gateway-guide/api-gateway-financial-services)[74. API Gateway Architecture for E-Commerce: Checkout Reliability and Traffic Peaks](https://api7.ai/learning-center/api-gateway-guide/api-gateway-ecommerce)[75. API Gateways for Mobile Applications: Authentication, Payloads, and Versioning](https://api7.ai/learning-center/api-gateway-guide/api-gateways-mobile-applications)[76. API Gateways for Web3 Applications: RPC Traffic, Identity, and Abuse Controls](https://api7.ai/learning-center/api-gateway-guide/api-gateways-web3-applications)[77. OpenAPI-Driven API Gateway Operations: Import, Validation, and Drift Control](https://api7.ai/learning-center/api-gateway-guide/openapi-driven-api-gateway-operations)[78. gRPC-Web and gRPC Transcoding Through an API Gateway](https://api7.ai/learning-center/api-gateway-guide/grpc-web-grpc-transcoding-api-gateway)[79. API Gateway Pricing and Cost Optimization: A Workload-Based Model](https://api7.ai/learning-center/api-gateway-guide/api-gateway-pricing-cost-optimization)[80. Evaluating API Gateway Directions: Evidence and Architectural Impact](https://api7.ai/learning-center/api-gateway-guide/api-gateway-trends) 09 Advanced Gateway Applications [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=operations)[81. API Gateways in Zero Trust Architecture: Identity, Policy, and Limits](https://api7.ai/learning-center/api-gateway-guide/api-gateways-zero-trust-architecture)[82. API Gateway Log Analytics: Correlation, Queries, and Operational Signals](https://api7.ai/learning-center/api-gateway-guide/api-gateway-log-analytics)[83. From API Sprawl to Governed Delivery: The Gateway's Role in Modernization](https://api7.ai/learning-center/api-gateway-guide/api-gateway-modernization)[84. API Monetization at the Gateway: Plans, Metering, Entitlements, and Billing Boundaries](https://api7.ai/learning-center/api-gateway-guide/api-monetization-gateway)[85. Safe AI-Assisted API Gateway Optimization: Recommendations, Guardrails, and Approval](https://api7.ai/learning-center/api-gateway-guide/ai-assisted-api-gateway-optimization)[86. API Gateways for Low-Code and No-Code Integration: Governance and Safety](https://api7.ai/learning-center/api-gateway-guide/api-gateways-low-code-no-code-integration)[87. API Gateway and CIAM Integration: Token Validation, Consent, and Identity Context](https://api7.ai/learning-center/api-gateway-guide/api-gateway-ciam-integration)[88. Elastic API Gateway Scaling: Signals, Capacity, and Safe Scale-In](https://api7.ai/learning-center/api-gateway-guide/elastic-api-gateway-scaling)[89. Multi-Tenant SaaS API Gateways: Isolation, Quotas, and Tenant-Aware Policy](https://api7.ai/learning-center/api-gateway-guide/multi-tenant-saas-api-gateway-policy)[90. API Gateway DevSecOps: Policy as Code, Testing, and Runtime Feedback](https://api7.ai/learning-center/api-gateway-guide/api-gateway-devsecops) 10 Platform Engineering and Planning [View this topic · 10](https://api7.ai/learning-center/api-gateway-guide?topic=platform-governance)[91. API Discovery and Documentation at the Gateway: Inventory, Ownership, and Drift](https://api7.ai/learning-center/api-gateway-guide/api-discovery-documentation-gateway)[92. WebAssembly Plugins for API Gateways: Portability, Isolation, and APISIX Boundaries](https://api7.ai/learning-center/api-gateway-guide/api-gateway-webassembly-plugins)[93. Monitoring API Gateways with Prometheus and Grafana: Metrics, Dashboards, and Alerts](https://api7.ai/learning-center/api-gateway-guide/monitor-api-gateways-prometheus-grafana)[94. API Gateway Reliability Engineering: SLOs, Failure Isolation, and Incident Response](https://api7.ai/learning-center/api-gateway-guide/api-gateway-reliability-engineering)[95. API Gateways for Edge AI Inference: Routing, Constraints, and Observability](https://api7.ai/learning-center/api-gateway-guide/api-gateways-edge-ai-inference)[96. Reducing Cloud Cost with API Gateway Controls: Measurement Before Optimization](https://api7.ai/learning-center/api-gateway-guide/reducing-cloud-cost-api-gateway-controls)[97. Improving API Developer Experience with Gateway Standards and Self-Service](https://api7.ai/learning-center/api-gateway-guide/improving-api-developer-experience-gateway-self-service)[98. API Gateway Change Management: Compatibility, Progressive Delivery, and Rollback](https://api7.ai/learning-center/api-gateway-guide/api-gateway-change-management-rollback)[99. Operating Serverless APIs: Cold Starts, Idempotency, and Asynchronous Handoffs](https://api7.ai/learning-center/api-gateway-guide/operating-serverless-apis-gateway)[100. Planning an API Gateway Roadmap for the Next Five Years](https://api7.ai/learning-center/api-gateway-guide/planning-api-gateway-roadmap-next-five-years) [API Gateway Guide](https://api7.ai/learning-center/api-gateway-guide)[Gateway Security](https://api7.ai/learning-center/api-gateway-guide?topic=security) On this page On this page - [Key Takeaways](#key-takeaways) - [Start with the Failure Point, Not the Product](#start-with-the-failure-point-not-the-product) - [Use a Layered DDoS Architecture](#use-a-layered-ddos-architecture) - [Prevent Direct-Origin Bypass](#prevent-direct-origin-bypass) - [Bound Application-Layer Resource Consumption](#bound-application-layer-resource-consumption) - [Rate and quota](#rate-and-quota) - [Concurrency](#concurrency) - [Request shape and size](#request-shape-and-size) - [Authentication and operation controls](#authentication-and-operation-controls) - [Caching](#caching) - [Configure APISIX as the Admission Layer](#configure-apisix-as-the-admission-layer) - [Protect the Gateway Itself](#protect-the-gateway-itself) - [Detect Attacks with Multiple Signals](#detect-attacks-with-multiple-signals) - [Build an Incident Runbook](#build-an-incident-runbook) - [Test Without Creating an Incident](#test-without-creating-an-incident) - [DDoS Readiness Checklist](#ddos-readiness-checklist) - [Summary](#summary) - [FAQ](#faq) - [Can an API gateway stop a volumetric DDoS attack?](#can-an-api-gateway-stop-a-volumetric-ddos-attack) - [Is per-IP rate limiting enough for API DDoS defense?](#is-per-ip-rate-limiting-enough-for-api-ddos-defense) - [Will autoscaling solve an application-layer DDoS attack?](#will-autoscaling-solve-an-application-layer-ddos-attack) - [Next Steps](#next-steps) Article 51 # DDoS Defense at the API Gateway: Layered Controls and Failure Planning API7.ai September 8, 2026 An API gateway helps defend against application-layer DDoS by authenticating callers, validating requests, bounding rate, concurrency, and body size, and shedding expensive work before it reaches services. It cannot by itself stop an attack that saturates the network link before traffic reaches the gateway. Effective defense places provider, CDN, anycast, or scrubbing capacity upstream; restricts direct access to the origin; and uses the gateway as the application-aware admission layer. ## Key Takeaways - Match each control to the attack layer; one “DDoS protection” switch does not cover every failure mode. - Stop volumetric floods upstream of the constrained link, not at an origin that traffic has already saturated. - Prevent bypass by allowing the intended edge path to reach the gateway and protecting the origin address. - At the gateway, constrain resource cost as well as request count: concurrency, payload size, pagination, batch width, and expensive operations matter. - Use trusted identity and verified client-address restoration before applying per-client policies. - Rehearse detection, escalation, mitigation, and recovery while dependencies are degraded. ## Start with the Failure Point, Not the Product [CISA's DDoS guidance](https://www.cisa.gov/sites/default/files/2024-03/understanding-and-responding-to-distributed-denial-of-service-attacks_508c.pdf) distinguishes attacks that exhaust bandwidth, protocol or infrastructure state, and application resources. The useful question is not simply “Can the gateway block DDoS?” It is “Which resource becomes unavailable first, and can the control act before that point?” | Attack pattern | Likely scarce resource | Control must act | | ------------------------------ | -------------------------------------------- | ------------------------------------------------- | | Very high packet or bit rate | Internet link, load balancer, firewall state | Provider edge, CDN/anycast, or scrubbing service | | Connection or handshake flood | L4/L7 proxy state, CPU, sockets | Upstream edge and connection-aware proxy controls | | High-rate HTTP requests | Gateway or upstream request capacity | Edge and gateway rate/admission policy | | Low-rate expensive requests | Database, search, compute, external spend | Gateway plus application-specific cost bounds | | Credentialed distributed abuse | Business operation and tenant capacity | Identity-aware gateway and application controls | If a 100 Gbit/s flood reaches a 10 Gbit/s origin path, a gateway behind that path cannot inspect its way out of saturation. Filtering must occur where sufficient capacity exists. Conversely, an upstream network service cannot always tell that one valid-looking GraphQL query or export request is disproportionately expensive. The gateway and application must enforce that semantic boundary. ## Use a Layered DDoS Architecture ``` flowchart LR I[Internet] --> E[Provider / Anycast / CDN / Scrubbing] E --> L[Load balancer or L4 protection] L --> G[API Gateway] G --> S[Isolated upstream pools] S --> D[(Databases and dependencies)] O[Control plane and admin access] -. separate path .-> G ``` Each layer has a distinct job: - **Provider or distributed edge:** absorbs or diverts volumetric traffic and blocks obvious network/protocol floods before the origin link. - **Load balancer/L4 layer:** manages connection state, SYN behavior, and transport-level health. - **API gateway:** restores trusted identity, authenticates, validates, limits, prioritizes, and observes application requests. - **Application and dependencies:** enforce operation-specific invariants, cost limits, authorization, and spending caps. - **Control plane:** remains private and operational even when the public data plane is under pressure. A web application firewall can add signatures and behavioral detection, but it does not replace capacity engineering, authentication, rate limits, or application bounds. For a concrete Apache APISIX integration, see the [`chaitin-waf` plugin documentation](https://apisix.apache.org/docs/apisix/plugins/chaitin-waf/). ## Prevent Direct-Origin Bypass An attacker should not be able to discover the gateway or origin address and avoid the upstream defense. Depending on deployment, controls can include: - network access rules that accept data-plane traffic only from documented edge ranges; - mutually authenticated connections between edge and origin; - private connectivity or tunnels; - removal of stale DNS records and leaked addresses; - separate, restricted health-check and administrative paths; - monitoring for traffic arriving outside the intended path. IP allowlists change and can lock out legitimate traffic if automation fails. Use provider-published ranges, atomic updates, overlap during rotation, and an emergency recovery path. Do not copy a range once and assume it remains current. Restore the original client address only from a trusted proxy. If the gateway accepts `X-Forwarded-For` directly from the internet, an attacker can choose the apparent source and evade or frame per-IP rules. Strip untrusted forwarding headers at the first trusted hop and configure address restoration for the exact proxy chain. ## Bound Application-Layer Resource Consumption [OWASP API4:2023](https://owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/) identifies unrestricted execution time, memory, file descriptors, upload size, batch operations, pagination, and third-party spending as API risks. DDoS defense must therefore budget work, not merely count packets. ### Rate and quota Apply route- and identity-specific request rates. A password reset, report export, login, and cached catalog read should not share one arbitrary threshold. Use per-tenant or per-credential policy after authentication when possible; IP-only limits can penalize users behind shared networks and are easier for distributed attackers to spread across. ### Concurrency A low request rate can still hold all worker or database slots with slow operations. Use [concurrency budgets](https://api7.ai/learning-center/api-gateway-guide/api-gateway-concurrency-control) at expensive routes and upstream pools. Reject before an unbounded gateway or application queue forms. ### Request shape and size Bound body bytes, header size, decompressed size, array length, pagination, GraphQL complexity, batch width, archive expansion, and response size where relevant. Validate these limits again in the application; the gateway may not understand every semantic cost. ### Authentication and operation controls Authentication raises attacker cost and enables fairer attribution, but compromised credentials are still valid credentials. Limit sensitive operations per subject and tenant, detect abnormal use, and make revocation fast. Put financial caps and alerts around SMS, email, AI inference, and other metered dependencies. ### Caching Caching stable public reads can reduce upstream work, but an attacker can defeat naive caches with unique query strings, headers, or keys. Normalize the cache key deliberately, reject meaningless variance, and never cache private responses without correct isolation. ## Configure APISIX as the Admission Layer Apache APISIX 3.18 provides complementary traffic and security plugins. This illustrative route combines request-rate and concurrency controls for a costly public search endpoint: ``` curl "http://127.0.0.1:9180/apisix/admin/routes/catalog-search" \ -X PUT \ -H "X-API-KEY: ${admin_key}" \ -d '{ "uri": "/v1/catalog/search", "methods": ["GET"], "plugins": { "limit-req": { "rate": 20, "burst": 10, "key_type": "var", "key": "remote_addr", "rejected_code": 429 }, "limit-conn": { "conn": 80, "burst": 0, "default_conn_delay": 0.1, "key_type": "var", "key": "server_addr", "rejected_code": 503 }, "prometheus": {} }, "upstream": { "type": "roundrobin", "nodes": { "catalog.internal:8080": 1 } } }' ``` The numbers and keys are examples. `remote_addr` is meaningful only after the trusted-proxy design is correct. `server_addr` demonstrates an instance-oriented safety key, not a single shared fleet counter. Establish values from legitimate bursts, gateway topology, and measured upstream capacity. The [`limit-req` plugin](https://apisix.apache.org/docs/apisix/plugins/limit-req/) constrains arrival rate; [`limit-conn`](https://apisix.apache.org/docs/apisix/plugins/limit-conn/) bounds concurrent requests. Use `429` for the caller-facing rate policy and `503` for shared capacity pressure so operators and clients can distinguish the conditions. For uploads, APISIX's [`client-control` plugin](https://apisix.apache.org/docs/apisix/plugins/client-control/) can set `max_body_size`, but the current documentation states that it requires APISIX-Runtime. Verify that prerequisite for your distribution. Otherwise enforce the body boundary in the supported listener/runtime configuration and again in the application. APISIX `ip-restriction` can support an allowlist or denylist, but IP blocking alone is weak DDoS defense: source addresses may be numerous, spoofed at some layers, shared by legitimate clients, or changed. Use it for a well-defined trust boundary such as approved edge ranges, not as the entire incident strategy. ## Protect the Gateway Itself Gateway policies consume resources too. During an attack: - avoid synchronous logging or remote policy calls on every rejected request; - sample or aggregate high-volume rejection telemetry without losing incident counts; - limit high-cardinality labels such as raw IP or unbounded user agent; - keep configuration distribution and administrative APIs off the public listener; - reserve capacity for health probes and operator access; - test certificate and authentication costs under connection churn; - ensure autoscaling signals arrive before instances are already saturated. Autoscaling is not DDoS mitigation by itself. Scaling can lag, hit regional quotas, multiply cost, or expand an expensive downstream bottleneck. Put admission controls in front of autoscaling and set budget alerts and hard limits where a provider supports them. ## Detect Attacks with Multiple Signals The APISIX [`prometheus` plugin](https://apisix.apache.org/docs/apisix/plugins/prometheus/) exports request, status, bandwidth, and latency signals. Combine gateway observations with edge, load balancer, host, and application telemetry: - packets and bits per second at the provider edge; - connections opened, established, reset, and timed out; - requests, unique trusted identities, and geographic/network distribution; - `429`, `503`, authentication failures, and validation rejections by route; - request-size and operation-cost distributions; - gateway CPU, memory, sockets, event-loop lag, and upstream connections; - upstream latency, saturation, queue depth, and dependency spending; - cache hit ratio and cache-key cardinality. Baseline normal campaigns, releases, partner batches, and mobile retry behavior. A popular launch and an attack can look similar at the edge but require different business decisions. Automate protection for clear safety boundaries while keeping an accountable path for policy escalation. ## Build an Incident Runbook A DDoS runbook should name people, thresholds, and actions before an incident: 1. **Detect and classify.** Identify the saturated resource, protocols, routes, identities, and regions. 2. **Protect control.** Confirm operator access, configuration delivery, and observability remain available. 3. **Engage upstream help.** Know the provider or scrubbing-service escalation channel and information required. 4. **Apply reversible policy.** Tighten expensive routes or affected identities first; record the change and expiry. 5. **Preserve critical traffic.** Isolate health, authentication, payment, or operator paths according to business priorities. 6. **Communicate.** State impact and mitigation without publishing details that help an attacker bypass controls. 7. **Recover gradually.** Remove emergency rules in stages and watch for a returning attack or retry surge. 8. **Review evidence.** Update capacity, baselines, allowlists, contacts, and application limits. Avoid permanent emergency rules with no owner or expiry. They often become a later availability incident. ## Test Without Creating an Incident Coordinate DDoS tests with infrastructure providers and internal security teams. Use authorized environments and traffic volumes. Start with controlled application-layer scenarios: - a burst within legitimate campaign expectations; - distributed requests across many source addresses; - slow, concurrency-heavy requests; - large but schema-valid payloads; - repeated costly operations using valid credentials; - upstream pool loss while traffic remains high; - log and metric pressure from a high rejection rate. Verify that controls activate before the protected resource reaches its unsafe point, legitimate critical traffic retains its expected service, alerts identify the layer correctly, and rollback is available. Network-scale simulations require explicit provider coordination; do not point an internet load generator at production without authorization. ## DDoS Readiness Checklist - Which link, state table, worker pool, database, or paid dependency fails first? - Can volumetric traffic be filtered before that point? - Can attackers bypass the protected edge and reach the origin directly? - Are forwarding headers trusted only from known proxies? - Are rate, concurrency, payload, batch, pagination, and spending limits route-specific? - Can the gateway reject cheaply without blocking on logs or remote dependencies? - Are critical routes and operator access isolated? - Do provider escalation and policy changes have tested owners and procedures? - Are emergency rules reversible and time-limited? - Has recovery from the attack and subsequent client retry surge been rehearsed? ## Summary An API gateway is the application-aware part of DDoS defense, not the whole defense. Put high-capacity mitigation before constrained network links, prevent direct-origin bypass, then use gateway identity, validation, rate, concurrency, and size controls to protect application resources. Combine those controls with dependency limits, efficient telemetry, and a rehearsed incident runbook. The result is a layered system that fails deliberately instead of asking one gateway to absorb every attack type. ## FAQ ### Can an API gateway stop a volumetric DDoS attack? Not when the attack saturates the network before it reaches the gateway. Provider-edge, CDN, anycast, or scrubbing capacity must filter that traffic upstream. The gateway remains valuable for application-aware admission. ### Is per-IP rate limiting enough for API DDoS defense? No. Distributed attackers use many addresses, while legitimate users may share one address. Combine trusted client-address handling with identity-, route-, concurrency-, payload-, and operation-cost controls. ### Will autoscaling solve an application-layer DDoS attack? Autoscaling can add capacity, but it can lag, hit quotas, increase cost, or overload a fixed dependency. Use explicit admission limits and spending controls as well. ## Next Steps Map the first saturated resource for each public API and confirm where upstream mitigation acts. Then verify the current [APISIX rate-limiting](https://apisix.apache.org/docs/apisix/plugins/limit-req/) and [concurrency-limiting](https://apisix.apache.org/docs/apisix/plugins/limit-conn/) options for your deployment. For centrally managed Apache APISIX security policies, explore [API7 Enterprise](https://api7.ai/enterprise). [Previous topic · Gateway Performance**API Gateway TLS Performance: Handshakes, Session Reuse, and Measurement**](https://api7.ai/learning-center/api-gateway-guide/api-gateway-tls-performance)[Next article**Distributed API Gateway Rate Limiting: Local vs Redis Counters and Accuracy Trade-offs**](https://api7.ai/learning-center/api-gateway-guide/distributed-api-gateway-rate-limiting) On this page - [Key Takeaways](#key-takeaways) - [Start with the Failure Point, Not the Product](#start-with-the-failure-point-not-the-product) - [Use a Layered DDoS Architecture](#use-a-layered-ddos-architecture) - [Prevent Direct-Origin Bypass](#prevent-direct-origin-bypass) - [Bound Application-Layer Resource Consumption](#bound-application-layer-resource-consumption) - [Rate and quota](#rate-and-quota) - [Concurrency](#concurrency) - [Request shape and size](#request-shape-and-size) - [Authentication and operation controls](#authentication-and-operation-controls) - [Caching](#caching) - [Configure APISIX as the Admission Layer](#configure-apisix-as-the-admission-layer) - [Protect the Gateway Itself](#protect-the-gateway-itself) - [Detect Attacks with Multiple Signals](#detect-attacks-with-multiple-signals) - [Build an Incident Runbook](#build-an-incident-runbook) - [Test Without Creating an Incident](#test-without-creating-an-incident) - [DDoS Readiness Checklist](#ddos-readiness-checklist) - [Summary](#summary) - [FAQ](#faq) - [Can an API gateway stop a volumetric DDoS attack?](#can-an-api-gateway-stop-a-volumetric-ddos-attack) - [Is per-IP rate limiting enough for API DDoS defense?](#is-per-ip-rate-limiting-enough-for-api-ddos-defense) - [Will autoscaling solve an application-layer DDoS attack?](#will-autoscaling-solve-an-application-layer-ddos-attack) - [Next Steps](#next-steps)