DDoS Protection

HEIMWALL offers two types of L7 DDoS protection: automatic protections that work without any configuration, and configurable layers that HEIMWALL manages once you enable them.

Automatic — works without writing any rules

Every domain you add starts with the following:

Managed Rules — signature-based filtering covering ~110 attack types. SQL injection, XSS, path traversal and the fingerprints of common DDoS tools are stopped at this layer. No rules required.

Threat Intelligence Deny List — an automatically updated block list of known malicious IPs, botnet exit nodes and open proxies.

OWASP Signature Scanning — real-time scanning for attack patterns in the OWASP Top 10 categories.

Per-server local limit — every HEIMWALL node monitors the instantaneous request rate passing through it. If the rate exceeds the domain’s per-server ceiling, the system automatically starts a challenge; once traffic returns to normal, it stops. No rules to write, no threshold to set.

Auto Challenge — on by default with JS Challenge

Every new domain arrives with auto protection enabled at 200 RPS and JS Challenge mode. When traffic crosses the threshold, HEIMWALL automatically starts a challenge for all visitors; once traffic normalizes and the standby period expires, the protection turns off. While the attack continues, the window renews automatically.

From Console → WAF → [domain] → Protection you can adjust the threshold or switch to CAPTCHA mode. You don’t have to monitor the attack; if you have a webhook configured, the system notifies you when it kicks in. Details: Verification Settings

Automatic Blocking — auto-bans repeat offenders

Off by default. Set the failure threshold and ban duration from Console → WAF → [domain] → Protection. When an IP accumulates a set number of rule violations or challenge failures, HEIMWALL adds it to a temporary ban list — no manual action needed. Details: Challenge & Failban

You can also increment the counter for specific error codes using the failban action in the rule engine:

# Add 401 errors to the auto-ban counter
IF   http.response.status == 401
THEN failban

With these selections in the console: Field Origin Response Status · Operator equals · Value 401 → Action Auto-Block

Rate Limit rules — per-path request caps

You add rate limits to critical endpoints via the rule engine; HEIMWALL enforces them automatically.

IF   http.request.base_uri == /login
THEN ratelimit 20/60s

With these selections in the console: Field Path (without query) · Operator equals · Value /login → Action Rate Limit (20 requests / 60 s)

Bot Score rules — behavioural filtering

Every request receives a bot score from 0 to 100. Attack traffic typically scores above 60. You set the thresholds using the waf.bot_score field in the rule engine:

IF   waf.bot_score ge 80
THEN block

IF   waf.bot_score ge 50
AND  waf.bot_score lt 80
THEN captcha

With these selections in the console:

Field Bot Score (0–100) · Operator greater or equal · Value 80 → Action Block
Field Bot Score (0–100) · Operator greater or equal · Value 50 AND Operator less than · Value 80 → Action CAPTCHA

Waiting Room — protects the origin from overload

From Console → WAF → [domain] → Waiting Room, you set the concurrent session limit. Details: Waiting Room When capacity is reached, excess visitors wait in a queue and are admitted in controlled batches — the origin stays up, and real users can still reach your site.

Summary

Protection	How it works
Managed Rules	Automatic — no rules needed
Threat Intelligence Deny List	Automatic — no rules needed
OWASP Signature Scanning	Automatic — no rules needed
Per-server local limit	Automatic — no threshold needed
Auto Challenge (RPS)	On by default — 200 RPS + JS
Failban	You enable it, HEIMWALL enforces
Rate Limit	You write the rules, HEIMWALL enforces
Bot Score rules	You write the rules, HEIMWALL enforces
Waiting Room	You set it up, HEIMWALL manages it