DDoS Mitigation

Hello everyone! Recently, my website was hit with a massive DDoS attack. Although it seems traffic was mitigated by Vercel, all of my Edge requests have been used. Is there any way I could get these back?, the website seems to still be working however.

All requests were cached and immediately filled up my free edge requests. I currently have attack mode enabled in case of another attack.

You can visit the site to take a look at https://unhittable-site.vercel.app/

The domain troubleshooting guide can help with most custom domain configuration issues. You might be able to use that guide to solve it before a human is available to help you. Then you can come back here and share the answer for bonus points.

https://vercel.com/docs/projects/domains/troubleshooting

You can also use v0 to narrow down the possibilities.

You've already done the right thing by going on attack challenge mode. I recommend keeping that on. Vercel does have solid built-in DDoS protection, but unfortunately, because those Edge requests were technically "consumed" during the attack, they usually aren't restored to your account automatically.

Here is what I’d recommend doing next:

Review your caching strategy: Take a look at your setup to ensure you’re maximizing cache efficiency. The more you can serve from the cache, the less strain there is on your resources.
Consider the Pro plan: If you find you need higher Edge request limits and more robust DDoS protection moving forward, upgrading to Pro might be a good move for the extra peace of mind.

Since billing and request limits are specific to your account, you’ll need to contact Vercel Support directly through your dashboard.

To prevent this in the future, I recommend:

Implement rate limiting: It’s worth looking into adding rate limiting directly within your application logic.
Leverage WAF: If you do move to a Pro plan, you can use Vercel’s Web Application Firewall (WAF) features for much tighter security.
Monitor spikes: Try to keep a closer eye on your usage metrics so you can spot and react to unusual traffic spikes as early as possible.

I hope this gets resolved quickly for you!

Hey there, ! Just checking in to see if you still need help with the Edge requests after the DDoS attack or if you found a solution. Let me know!

Hey there, apologies I just saw your message. If I were to implement rate limiting, would legitimate traffic get rate limited as well, and also would requests still be cached even if they were rate-limited?, Thanks for your help!