How we automated the defense of a coordinated L7 flood
Last night our main and backup domains faced a coordinated 88M request DDoS attack. Here is how standard Under Attack Mode failed, and how we neutralized it using Vercel origin lockdown and FlareStack automated IP syncing.
Automated edge-native IP blocking
Blocking hundreds of abusive IPs manually isn't sustainable. Discover FlareStack: an open-source, edge-native IP reputation system built on Cloudflare Workers and D1 that stops abuse with zero added latency.
Why standard defenses fail against modern botnets
After surviving a massive Layer 7 DDoS attack, I documented the critical flaws in standard security approaches. From the limitations of rate limiting to the dangers of blunt instruments like 'Under Attack' mode, here is what I learned.
Holding the line against 230k reqs/IP
An inside look at the massive DDoS attack that hit our infrastructure in February 2026. We analyze the shift from broad botnets to targeted floods peaking at 233,780 requests/IP and how we mitigated it.