DDoS protection

Every service on Muerte Cloud sits behind the same anycast edge that absorbs volumetric and application-layer attacks before they reach your app. This page explains what's included by default, what you can tune per service, and how the platform behaves during an incident.

There is nothing to enable, no upgrade path, and no additional charge for attack traffic. Protection applies equally to Web Services, Static Sites and custom domains, on both the built-in *.muerte.app hostnames and your own domains.

Included on every plan

Volumetric (L3/L4) and protocol-level protection is always on and always free. Application-layer (L7) mitigation runs automatically on any hostname served through the edge.

What's protected#

Field	Description
Network layer (L3/L4)	SYN floods, UDP amplification, reflection attacks and volumetric traffic are absorbed by the anycast edge across multiple continents. Bad packets never reach a service.
Protocol layer	TCP state exhaustion, slowloris, malformed TLS handshakes and HTTP smuggling attempts are dropped at the edge before a connection is proxied.
Application layer (L7)	HTTP floods and low-and-slow attacks are throttled by adaptive per-IP and per-ASN limits. Suspicious clients get a lightweight challenge before their requests are proxied.
TLS termination	Certificates and keys live only at the edge. Attackers cannot exhaust your service's TLS stack because they never speak TLS to it.

How mitigation works#

The edge builds a live signal of "normal" for each hostname — request rate, method mix, path entropy, ASN distribution — and flags deviations in real time. When a deviation looks like an attack, the edge escalates through three stages:

1. Fingerprint drop

Requests matching known-bad fingerprints (reused botnets, spoofed UAs, malformed HTTP) are dropped at the edge with no upstream call.

2. Adaptive challenge

Ambiguous traffic gets a JavaScript or managed challenge. Real browsers solve it in milliseconds; scripted clients drop off.

3. Under-attack mode

If pressure keeps rising, an origin-protecting mode kicks in automatically. Verified traffic passes, everything else waits or is dropped.

Your logs stay clean

Traffic dropped at the edge never reaches your service, so your access logs, metrics and per-request compute bill only reflect legitimate load. Aggregate attack stats live in the service's Security tab.

Service-level controls#

Edge protection covers volumetric and generic L7 attacks. For abuse patterns specific to your app — a slow endpoint being hammered, brute-force login attempts, expensive search queries — add service-level rules from the dashboard:

Field	Description
Per-route rate limits	Limit requests per IP, per API key or per user on a specific path pattern. Excess requests get a 429 with a Retry-After header.
Method allowlist	Deny methods your service doesn't use — most APIs never need TRACE or CONNECT — before requests hit compute.
Geo rules	Block or challenge traffic by country. Useful for regional apps and compliance boundaries.
Bot management	Managed bot categories (search, monitoring, AI crawlers, unknown automation) with per-category allow, challenge or block actions.
IP and ASN lists	Static allow/deny lists for known partners, VPN ranges or repeat offenders.

Example: rate-limit rule

A rule that limits POST /login to 10 requests per IP per minute, with a five-minute cool-off after breach:

yaml

# service settings → security → rules
- name: login-bruteforce
  match:
    method: POST
    path: /login
  action: rate-limit
  limit:
    requests: 10
    per: 1m
    key: ip
  on-breach:
    response: 429
    cool-off: 5m

Signals your app receives#

Every request that passes the edge carries headers your app can trust — the edge strips and reissues them, so incoming forgeries are ignored.

Field	Description
X-Forwarded-For	Original client IP. Use this instead of the socket peer address.
X-Muerte-Country	Two-letter country code the request originated from.
X-Muerte-ASN	Autonomous system number of the client's network.
X-Muerte-Trust	Edge trust score for the request: verified, unknown or suspicious. Use it to gate expensive endpoints.
X-Request-ID	Stable per-request ID. Log it — support can trace it end to end.

During an incident#

Sustained attacks are visible in real time on the service's Security tab: request rate, block rate, top ASNs and top countries. A workspace-level notification fires the moment mitigation escalates past the fingerprint stage — see Notifications.

Don't disable protection during a spike

If a marketing launch or viral moment triggers a challenge on legitimate users, raise a support ticket rather than turning rules off. We can tune thresholds for a specific hostname within minutes without exposing the origin.

Fair-use and hard limits#

No per-attack surcharge

You are never billed for traffic dropped at the edge, regardless of the size of the attack.

Bandwidth accounting

Egress from your origin to legitimate clients is metered normally. Attack traffic that never reaches your service is not counted.

Enterprise escalation

Multi-hundred-Gbps sustained attacks are handled without any action on your side. Contact support if you expect a targeted campaign so we can pre-position rules.

Related reading: Custom domains for how TLS and edge routing are set up, and Notifications for wiring security events into your on-call rotation.