I have designed a backend service which is only accessible via a custom REST API. As I understand, services such as CloudFlare are designed to protect HTTPS traffic, and do not apply for custom APIs.

How can I protect my API against DDoS attacks? What services, tools and design considerations should I bear in mind to protect my API service from DDoS attacks?


1 Answer 1


I'd suggest to hide your REST API behind a so-called API Gateway. Such components should handle that.

I know that APIGee provides different features (http://docs.apigee.com/api-services/content/comparing-quota-spike-arrest-and-concurrent-rate-limit-policies) that can help to mitigate DDoS attacks.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .