Learning centre: How this all
actually works.

What is a WAF (Web Application Firewall)?

A web application firewall inspects HTTP requests and blocks SQL injection, XSS and bot abuse before they reach your app. How it works and what it misses.

What is DDoS mitigation?

DDoS mitigation filters attack traffic while real users keep getting through. Detection, techniques compared, always-on vs on-demand, pricing and set-up.

What is rate limiting?

Rate limiting caps how many requests a client may make in a period. The main algorithms, what to key on, an nginx example and the right 429 response.

How to hide your origin IP address

If attackers find your real server IP they can bypass your DDoS protection entirely. The common ways an origin leaks and how to lock it down properly.

What is a proof-of-work challenge?

A proof-of-work challenge makes a browser solve a small computation before a page loads. Why it beats CAPTCHAs and how it changes attack economics.

What is DDoS-protected hosting?

DDoS-protected hosting puts filtering in front of your server by default. How it differs from adding protection later, and what to check before buying.

02Attacks & threats

20 articles

What is a DDoS attack?

A DDoS attack floods a target from many machines at once until it stops serving real users. Attack types, warning signs, real-world scale and defences.

What is credential stuffing?

Credential stuffing replays username and password pairs leaked in other breaches against your login. How it works, how to spot it and how to stop it.

What is a SYN flood attack?

A SYN flood fills a server's connection table with handshakes it never finishes. How it works, why SYN cookies stop it, and how to spot one.

What is a UDP flood?

A UDP flood drowns a target in connectionless packets it must inspect and discard. Why game servers suffer most, and why null-routing is not protection.

What is a DNS amplification attack?

DNS amplification turns small spoofed queries into large replies aimed at a victim, using open resolvers. How reflection works and how to defend.

What is a botnet?

A botnet is a network of compromised machines controlled remotely and used for attacks, fraud and spam. How they are built, controlled and detected.

03Guides

17 articles

502 Bad Gateway: what it means and how to fix it

A 502 means a proxy got a bad answer from the server behind it. Find which hop failed, read the exact log line, and fix the upstream instead of guessing.

504 Gateway Timeout: causes and how to fix it

A 504 means a proxy gave up waiting for the server behind it. Work out which timeout fired, read the log line, and fix the slow layer instead of the timer.

503 Service Unavailable: what it means and how to fix it

A 503 means a server is refusing work for now: maintenance, overload, a stopped app pool or a rate limit. Find which one, fix it and protect your rankings.

How to read a traceroute and an MTR report

Read traceroute, MTR and WinMTR output correctly: hops, asterisks and latency jumps, why mid-path loss is often harmless, and what to send your provider.

How to protect a Minecraft server from DDoS attacks

Put players on a protected proxy, firewall the backend to it, and pick a host that filters TCP floods, bot joins and Bedrock UDP. Tested firewall rules.

FiveM DDoS protection: hide the endpoint, filter port 30120

How a FiveM server's IP leaks, the Cfx.re settings that hide it, and what UDP filtering on port 30120 must do. Tested firewall rules and capture filters.

04Network & delivery

18 articles

Layer 3/4 vs Layer 7 protection: what is the difference?

Layer 3/4 filters packets; Layer 7 understands HTTP requests. Which you need depends on whether you protect a website or a game server, mail host or VPN.

What is GRE tunneling?

GRE wraps packets inside other packets to create a virtual link between networks. How GRE tunnels deliver scrubbed traffic, hide an origin IP and go wrong.

What is a CDN (Content Delivery Network)?

A CDN stores copies of your content worldwide so visitors are served from nearby. How caching works, what it does for speed, and how it absorbs attacks.

What is a reverse proxy?

A reverse proxy accepts requests for your servers and decides what to forward. How it differs from a forward proxy and why CDNs and WAFs are built on it.

What is Anycast?

Anycast advertises one IP address from many locations so each visitor reaches the nearest. How it lowers latency and spreads attack traffic network-wide.

What is SSL/TLS?

TLS encrypts traffic and proves a server is genuine. How the handshake works, what certificates actually prove, and why SSL is the wrong word for it.

05Bots & traffic

7 articles

What are web crawlers and bots?

Web crawlers are automated programs that fetch pages: search engines, AI bots, preview fetchers and scrapers. How to verify who is really crawling you.

What is bot management?

Bot management identifies automated traffic and decides what each kind may do. Detection signals, fingerprinting, challenges and avoiding false positives.

What is TLS fingerprinting (JA3 and JA4)?

TLS fingerprinting identifies the software behind a connection from its handshake. How JA3 and JA4 work, what they reveal and where they fail.

What is web scraping?

Web scraping extracts data from websites automatically. How scrapers work, when it hurts and what reduces it without blocking search engines.

What is a CAPTCHA challenge? Types, accessibility and privacy

A CAPTCHA is a challenge–response test that tells people from bots. Compare eight types on solve time, accessibility, privacy and how well bots solve them.

9 min read

Mathematical CAPTCHA: how it works, how to build one and where it fails

A math CAPTCHA asks a sum before a form is sent. How to verify it server-side, why scripts still solve it, its cost to disabled users, and better options.