HTTP Flood Attack
An HTTP Flood is an application-layer (Layer 7) DDoS attack that overwhelms a web server by sending massive volumes of seemingly legitimate HTTP requests. Unlike volumetric attacks that saturate bandwidth, HTTP floods exhaust server resources — CPU, memory, database connections, and application threads — by forcing the server to process each request individually, making them extremely difficult to distinguish from real traffic.
How HTTP Flood Attack Works
HTTP flood attacks mimic normal user behavior at extreme scale. Because each request appears legitimate (valid headers, proper HTTP format), traditional network-level DDoS mitigation tools cannot detect them. The attack targets the application layer, where each request consumes significantly more server resources than network bandwidth.
Assemble a botnet or attack infrastructure
The attacker controls a network of compromised devices (botnet) or rents DDoS-as-a-service infrastructure. Modern botnets include IoT devices, compromised servers, and residential proxies that generate traffic from diverse, legitimate-looking IP addresses.
Identify resource-intensive endpoints
The attacker profiles the target to find endpoints that consume disproportionate server resources: search pages, API endpoints with database queries, dynamic page generation, file downloads, or login forms that trigger bcrypt hashing.
Launch the flood
Thousands of bots simultaneously send HTTP GET or POST requests to the target. GET floods request pages or assets; POST floods submit forms or API payloads. Each request is syntactically valid and may include realistic headers, cookies, and user agents.
Server resources exhaust
The server's worker threads, database connection pool, and memory are consumed by processing the flood. Legitimate users experience extreme slowness, timeouts, or complete unavailability. The application may crash or the server may become unresponsive.
Real-World Examples
GitHub DDoS attack
GitHub was hit with 1.35 Tbps of traffic, the largest DDoS attack recorded at the time. While primarily a memcached amplification attack, it included significant HTTP flood components targeting the application layer.
AWS Shield report: HTTP floods dominate L7
AWS reported that HTTP flood attacks accounted for over 60% of application-layer DDoS events mitigated by AWS Shield in 2023, with peak attacks exceeding 100 million requests per second.
Cloudflare mitigates record HTTP DDoS
Cloudflare reported mitigating an HTTP/2-based DDoS attack peaking at 201 million requests per second, originating from approximately 20,000 compromised devices across 132 countries.
Impact & Risk Assessment
HTTP floods cause service unavailability, revenue loss, and reputational damage. E-commerce sites lose sales during downtime. SaaS platforms breach SLA commitments. The financial impact includes infrastructure overage costs (auto-scaling charges), incident response expenses, and customer churn. Unlike network-layer attacks, HTTP floods can bypass CDNs if not specifically configured for L7 mitigation.
How to Detect HTTP Flood Attack
Monitor request rates per IP and per endpoint for sudden spikes. Analyze request patterns for missing browser fingerprints (no JavaScript execution, no cookie support). Track the ratio of new vs. returning visitors during traffic spikes. Watch for abnormal geographic distribution of requests. Inspect User-Agent diversity — botnets often show limited or outdated agents. Use JavaScript challenges or CAPTCHA to verify human visitors during suspected attacks.
How to Prevent HTTP Flood Attack
Deploy a WAF with DDoS mitigation that can challenge suspicious traffic at the edge (JavaScript challenges, CAPTCHA). Implement rate limiting per IP, per session, and per endpoint. Use geographic-based access rules to block traffic from unexpected regions during attacks. Configure auto-scaling with spending limits to absorb surges without runaway costs. Cache aggressively — static responses consume minimal resources. Identify and protect resource-intensive endpoints with stricter rate limits. Deploy a CDN that absorbs traffic before it reaches the origin server.
Code Examples
# Define rate limiting zone (10 requests/second per IP)
limit_req_zone $binary_remote_addr zone=flood:10m rate=10r/s;
server {
location / {
# Allow burst of 20 requests, then delay
limit_req zone=flood burst=20 delay=10;
# Return 429 Too Many Requests instead of 503
limit_req_status 429;
proxy_pass http://backend;
}
# Stricter limits on resource-intensive endpoints
location /api/search {
limit_req zone=flood burst=5 nodelay;
proxy_pass http://backend;
}
}
PowerWAF automatically blocks HTTP Flood Attack at the edge.
Deploy in minutes. No code changes required. Free plan available.
Free plan spots are limited