Overview

Distributed Denial-of-Service (DDoS) and application-layer flood attacks can overwhelm websites, APIs and backend servers by generating excessive requests, exhausting connections or consuming application resources.

The GAJWAF DDoS / Layer-7 Flood Playbook provides a structured, seven-step incident-response procedure to help security teams identify, contain and recover from application-layer traffic floods while maintaining availability for legitimate users.

The playbook focuses on protecting applications against HTTP request floods, automated bot swarms and slow-client attacks through GAJWAF's application-layer security controls.

The guiding principle is simple: Prove It's a Browser. Cap Every Client.

Understanding the Scope of Protection

Not all DDoS attacks operate at the same network layer.

GAJWAF is designed to help mitigate Layer-7 (application-layer) attacks, including:

  • High-volume HTTP and HTTPS request floods.
  • Automated bot swarms targeting websites and application endpoints.
  • Slow-client attacks that hold application connections open.
  • Excessive requests directed at resource-intensive URLs and backend services.

Important: GAJWAF is not a replacement for network-layer DDoS protection.

Attacks involving saturated internet links, UDP floods, SYN floods or packet-level congestion require mitigation through upstream network providers, cloud DDoS protection services or traffic-scrubbing infrastructure.

What You'll Learn

The playbook covers seven essential stages of responding to DDoS and Layer-7 flood attacks.

Step 1: Identify and Classify the Attack

Learn how to distinguish application-layer floods from network-layer volumetric attacks.

The guide explains how to analyze HTTP request patterns, server load, backend health and network conditions to determine the appropriate response.

Step 2: Activate Under-Attack Mode

Use GAJWAF's Under-Attack Mode to introduce browser verification during an application-layer flood.

This helps distinguish legitimate browser traffic from automated clients while allowing administrators to configure appropriate handling for authenticated API clients, mobile applications and server-to-server integrations.

Step 3: Configure Rate Limits and Automatic Bans

Learn how to restrict excessive requests from individual clients and automatically ban sources that repeatedly exceed configured thresholds.

The playbook also explains why rate limits must be carefully configured to avoid affecting legitimate users behind shared networks, corporate proxies or NAT gateways.

Step 4: Restrict Concentrated Attack Sources

Apply targeted controls when malicious traffic originates from identifiable countries, hosting networks or specific application endpoints.

The guide covers geographic restrictions, network reputation policies and custom security rules for protecting frequently targeted URLs.

Step 5: Protect Backend Application Servers

Monitor upstream errors, application latency and backend availability to assess whether mitigation measures are reducing the load on protected servers.

The objective is to prevent malicious traffic from overwhelming the application infrastructure while preserving access for legitimate users.

Step 6: Escalate Network-Layer Attacks

Recognize situations where GAJWAF alone cannot mitigate the attack.

The playbook explains when to involve network or cloud infrastructure teams and use services such as AWS Shield, Azure DDoS Protection or upstream traffic-scrubbing solutions.

Step 7: Recover and Strengthen Protection

After the flood subsides, review temporary restrictions, retain effective security controls and restore normal operating conditions.

The guide also recommends reviewing recurring attack patterns and considering additional upstream protection when necessary.

Why This Playbook Matters

Application-layer floods can disrupt critical business services even when the underlying network infrastructure remains available.

Following this playbook helps security teams:

  • Identify the type of DDoS attack and choose the appropriate response.
  • Reduce malicious HTTP request volumes reaching backend servers.
  • Apply browser verification and automated bot protection.
  • Configure rate limiting and automatic bans.
  • Restrict concentrated attack sources without unnecessarily blocking legitimate users.
  • Monitor backend availability and application performance.
  • Escalate volumetric attacks to appropriate network-layer protection services.
  • Document incidents and improve future response procedures.

Incident Recovery and Validation

The playbook includes an incident-closure checklist to help administrators confirm that:

  • HTTP request rates have returned to normal levels.
  • Backend server health and application latency have recovered.
  • Legitimate users can access protected applications.
  • Temporary restrictions have been reviewed or removed.
  • Incident details and mitigation actions have been documented.

An incident-record template is also provided to capture attack classification, affected applications, peak request rates, attack sources, response measures and recovery information.

Download the Playbook

Document: GAJWAF Playbook – DDoS / Layer-7 Flood
Document Version: 1.0
Document Type: Incident Response Playbook
Publication: October 2026
Pages: 7
Intended Audience: GAJWAF Security Analysts, Administrators and Network Teams

Attachment: GAJWAF_Playbook_DDoS_L7_Flood.pdf

Download the attached PDF for detailed mitigation procedures, GAJWAF configuration references, escalation guidance and the incident-response checklist.

Related Documentation

For additional guidance, refer to:

Technical Support

For assistance with GAJWAF DDoS mitigation, application security policies or incident response, contact GajShield Technical Support or your authorized GajShield partner.

Website: https://www.gajshield.com

GAJWAF: Different Applications. Different Protection. Shared Risk Intelligence.