Defending a High-Traffic Mental Wellness Platform from a Coordinated Layer 7 DDoS Campaign. Learn how structured Cloudflare edge governance and server-level hardening restored stability, protected revenue, and reduced operational risk.
The Challenge
The client approached us in a state of urgency. Both their WordPress site and their app subdomain were under sustained Distributed Denial of Service (DDoS) attacks, affecting:
- Site uptime (frequent 503/504 errors)
- Page load speeds (>15s during peak)
- Admin panel access
- Checkout completion rate (down 60%)
They had tried basic rate limiting and WordPress security plugins, used generic Cloudflare protection, but these measures failed to mitigate the scale and sophistication of the attack. Also, WP Engine has always their server IP exposed which makes it easier to attack on the IP level directly.
What did
Devsec Global do
Step 1: Traffic Pattern Analysis & Attack Fingerprinting
We immediately initiated an emergency traffic audit via Cloudflare and server logs:
- Enabled Cloudflare “Under Attack” Mode
- Extracted Ray ID diagnostics
- Analyzed origin server logs (access/error)
- Deployed tools like iftop, netstat, and GoAccess to identify abusive IPs and User-Agents
Findings:
- Millions of requests coming from hundreds of unique IPs across different ASN blocks
- Spikes in traffic on /wp-login.php, /users/sign-in, /admin, and REST API endpoints
- Attack vectors included Layer 7 (HTTP flood) and slow POST attacks
- User-Agents were heavily randomized, suggesting botnet-level orchestration
Step 2: Multi-Layered Mitigation Strategy
A. Cloudflare WAF & Bot Management
We deployed an aggressive custom WAF rule set:
- Blocked all traffic from known bad ASN.
- JS Challenge for non-verified countries (e.g., outside client’s market)
- Challenge on high-risk paths like /wp-login.php, xmlrpc.php
- Rate Limiting rules on key endpoints (e.g., /wp-json, /cart, /users/sign-in)
- Turnstile CAPTCHA for sensitive POST requests
- Edge caching setup in place
B. Server-Side Protections
We strengthened origin server settings to complement Cloudflare:
- Installed Fail2Ban with custom regex for DDoS patterns
- Moved the client from WP Engine to GridPane and applied proper server-side security mitigation
- Activated 7G WAF on the server level that intercepts bad requests
Step 3: Continuous Monitoring and Response
For the next 10 days, we kept the site under 24/7 observation:
- Deployed Cloudflare alerting + server resource monitoring
- Captured new traffic signatures and updated WAF rules daily
- Sent daily summaries to the client with threat counts and status
Result:
- 0 downtime
- >99.99% success rate on real user requests
A couple of hundred million malicious requests blocked.
Outcome: Attackers Gave Up
After 2 weeks of unsuccessful attempts to break through our layered defense, the attack volume dropped sharply:
- The botnet eventually ceased targeting the site
- No ransom demands were issued
- Organic traffic and conversions returned to normal
- Checkout completion improved by 65%
Value Delivered
- Fast response and deep forensic analysis
- Zero data loss and no impact on customer trust
- Improved long-term security posture
- Client enrolled in our monthly Cloudflare Security Plan
Services Used
- Emergency Incident Response
- Custom Cloudflare WAF Configuration
- Server-level DDoS Hardening
- Traffic Analysis & Reporting
- Ongoing Bot Mitigation
