CC attacks exhaust origin resources with a flood of seemingly normal requests, slowing or even taking down a site. CC protection identifies abnormal high-frequency access at the edge and dampens or blocks it in time, keeping your origin from being overwhelmed.
What CC attacks are
Unlike volumetric DDoS, CC attacks are usually at the application layer: the requests themselves are legitimate, but a source issues far more than normal in a short window, concentrated on expensive endpoints or pages. They're hard to tell apart by hand and need automatic, behavior-based detection at the edge.
Rate limiting
Rate limiting is the most direct tool: set "requests allowed per unit time" for a path, and sources exceeding the threshold are blocked or challenged. Configure with headroom above your normal peak, so it stops abnormal surges without hurting real users.
- Set stricter thresholds for sensitive or expensive endpoints like login, checkout and search.
- Loosen them for static assets to avoid disrupting normal browsing.
Human verification
When a source is suspected to be automated, you can trigger a human-verification challenge: real browsers pass it automatically, while scripts are stopped. Compared with an outright ban, a challenge is friendlier to real users caught by mistake.
Tuning and monitoring
After enabling protection, watch hits in the security log: if real users get challenged, loosen the threshold; if abnormal traffic still slips through, tighten it. Attack patterns change, so periodic review and fine-tuning keep protection effective over time.