Application-layer attack (Layer 7)
A DDoS attack that targets the web application itself with requests that look legitimate, making it harder to distinguish from real traffic than a simple flood.
Why this is the hardest DDoS category to filter
Because the requests themselves follow normal protocol rules and often resemble genuine visitor behavior, distinguishing attack traffic from a real, if unusually large, spike in legitimate use requires looking at patterns over time rather than any single request in isolation.
Where a WAF fits in
A web application firewall sits in front of the application specifically to inspect and rate-limit this kind of traffic based on request patterns, which is a different job from a network-level firewall that only sees connections, not the requests inside them.
Frequently asked questions
Is this the same thing as a regular website getting a lot of legitimate traffic at once?
The traffic pattern can look similar at first, which is exactly why application-layer attacks are hard to catch quickly; the difference usually shows up in the source diversity and request patterns over a longer window.
What is a common target for this type of attack?
Login pages, search functionality, and any endpoint that triggers expensive server-side work per request, since those maximize damage per request sent.
Does a network firewall stop application-layer attacks?
Not effectively on its own, since the traffic passes standard network-level checks; a WAF or application-level rate limiting is generally required.
Want to see where your own server stands?
Run the free, read-only server check, or open the Security Lab and watch the detect, contain, recover, verify loop in action.
Get your free server checkOpen the Security Lab