01 / DECISION
When this primitive earns a place
Keep proxied traffic on Cloudflare, hide direct origin paths, and reserve application rate controls for expensive operations.
02 / ARCHITECTURE
Build the smallest defensible path
Inventory exposed IPs and protocols, separate volumetric from application-layer scenarios, define degradation behavior, and rehearse escalation contacts.
- 01Name the contract
Keep proxied traffic on Cloudflare, hide direct origin paths, and reserve application rate controls for expensive operations.
- 02Add one primitive
Inventory exposed IPs and protocols, separate volumetric from application-layer scenarios, define degradation behavior, and rehearse escalation contacts.
- 03Capture failure evidence
Verify no unintended origin exposure, monitor edge and origin traffic separately, and test controlled degradation without generating hostile traffic.
03 / REPRODUCE
Evidence before confidence
Verify no unintended origin exposure, monitor edge and origin traffic separately, and test controlled degradation without generating hostile traffic.
dig +short origin.example.com04 / BOUNDARY
The production boundary
DDoS protection cannot repair an origin reachable around the proxy or an endpoint whose normal request is intrinsically too expensive.
05 / FIRST-PARTY SOURCES
Keep first-party sources authoritative
Product behavior, limits, pricing, and availability can change. Re-check these sources before acting.