What Is a Layer 7 DDoS Attack? HTTP Flood, API DDoS and Application Layer Attacks

When DDoS attacks are mentioned, most people picture enormous traffic volumes.

Attacks measured in Gbps.

Millions of packets.

Botnets filling the internet link.

But not every modern DDoS attack works that way.

Some attacks target the application's most expensive points directly, at far lower traffic volumes.

A login service.

A search function.

A reporting screen.

A payment API.

A GraphQL query.

An authentication endpoint.

Attacks of this kind are called layer 7 DDoS – application layer DDoS.

In layer 7 DDoS attacks the target is not network bandwidth alone.

The aim is to consume the processing capacity of the web application, the API or the backend services.

Layer 7 attacks are therefore usually harder to detect than classic volumetric DDoS attacks.

Because the attack traffic can look technically entirely valid.

The HTTP request is correct.

The TLS connection is correct.

The TCP connection is correct.

The URL is real.

The problem lies less in the request itself than in;

its intensity, its behaviour and its cost on the backend.

In corporate DDoS security, therefore, layer 7 DDoS, HTTP flood, API DDoS, WAF, bot management, rate limiting and application resilience must be handled together.

What Is Layer 7 DDoS?

Layer 7 DDoS refers to DDoS attacks that take place at the application layer of the OSI model and aim to consume the resources of web applications, APIs or application services.

In these attacks the target may be;

• the web server,
• the application server,
• the authentication service,
• the API gateway,
• the database,
• the cache,
• the search engine,
• the payment service,
• a microservice backend.

Any of them can be the pressure point.

Layer 7 attacks are generally carried out over HTTP or HTTPS.

The traffic can therefore look entirely normal at the network level.

The real anomaly appears in the application's behaviour.

What Is the Difference Between Layer 7 DDoS and Layer 3/4 DDoS?

Layer 3 and layer 4 attacks mostly act on;

bandwidth,

packet processing,

the connection table,

TCP/UDP resources.

Layer 7 attacks target the application itself.

For example:

Layer 3/4

One million packets are sent.

Layer 7

One thousand complex API requests are sent.

The second attack generates far less network traffic.

But because each request performs far more work on the backend, the application can still become unusable.

For that reason:

The size of a DDoS attack is not always measured in Gbps.

In layer 7 attacks, requests per second (RPS), backend cost and response time can be far more meaningful.

What Is an HTTP Flood?

An HTTP flood is an application layer DDoS attack aimed at consuming system resources by sending large numbers of HTTP requests to a web application.

These requests can use;

GET,

POST,

PUT

or other HTTP methods.

The dangerous side of an HTTP flood is that the requests are valid.

For example:

GET /products

can be a normal request.

POST /login

can be a normal request.

GET /api/search

can be a normal request.

But when thousands of bots perform the same operation over and over, the application's resources can be exhausted.

What Is a GET Flood?

A GET flood is a layer 7 attack carried out by sending large numbers of HTTP GET requests.

The attacker may target endpoints such as;

product listing,

search,

report viewing,

dynamic content.

The critical point here is this:

Not every GET request costs the same.

A static file can easily be answered by the CDN.

But a dynamic page may require;

a database query,

a cache lookup,

session validation,

backend processing.

The attacker can therefore choose high-cost GET endpoints.

What Is a POST Flood?

A POST flood is a layer 7 attack formed by heavily sending POST requests that perform operations on the server.

Operations such as;

login,

form submission,

search,

payment requests,

API transactions

can use POST.

POST requests can consume more backend resources than GET requests on some systems.

On the WAF and API gateway, therefore, not only total traffic but endpoint-level behaviour must be monitored.

Why Can Gbps Be Low in Layer 7 Attacks?

An HTTP request may be a few kilobytes.

But that request can trigger operations on the backend such as;

10 database queries,

authentication,

a cache miss,

an external API call,

PDF generation.

For the attacker this is extremely efficient.

They send little traffic.

They create high processing cost.

This approach can be thought of as asymmetric resource consumption.

The attacker's cost is low.

The organisation's cost is high.

What Is an Expensive Endpoint?

An expensive endpoint is a URL or API function that consumes high resources on the backend when a request is processed.

Endpoints such as;

/search

/reports/export

/login

/api/recommendation

/invoice/create

can be high cost.

These endpoints can make heavy use of;

database,

CPU,

memory,

third-party API

resources.

Identifying these endpoints in advance is important for layer 7 DDoS resilience.

What Is API DDoS?

API DDoS refers to application layer DDoS attacks targeting API services.

APIs play a critical role in modern companies.

Mobile applications,

partner integrations,

microservices,

payment systems

can all run over APIs.

API availability is therefore directly related to business continuity.

An attacker may not need to shut the API down entirely.

Even a serious rise in response time can degrade service quality.

Why Are APIs a Valuable DDoS Target?

An API request usually triggers other services in the background.

For example;

API gateway

↓

authentication service

↓

application service

↓

database

↓

third-party service

can all run from a single request.

The attacker can use that small front-end request to create far greater backend cost.

API security is therefore not only about authentication and authorisation.

Availability and resource protection are part of API security too.

What Is the GraphQL DDoS Risk?

GraphQL allows the client to define which data it wants far more flexibly.

Where that flexibility is not properly bounded, it can turn into a resource consumption risk.

Complex or deep queries can create;

many resolvers,

nested queries,

database operations.

In GraphQL environments, therefore, controls such as;

query depth limits,

query complexity,

rate limiting,

timeouts,

resource quotas

are important.

The basic principle here:

The cost of a request should not be measured by byte count alone.

Why Is the Authentication Endpoint a Critical Target?

Login services can be critical for layer 7 attacks.

Because the login operation can involve;

password hashing,

a database lookup,

MFA interaction,

risk analysis,

an identity provider request.

Thousands of fake login requests can exhaust the authentication service's resources.

They can also make it harder for genuine users to sign in.

Controls such as;

rate limiting,

bot detection,

adaptive challenges,

account protection

are therefore necessary on login endpoints.

Are a Login Flood and Brute Force the Same Thing?

No.

In a brute force attack the aim is generally to find the account's password.

In a login flood the aim may be to exhaust the authentication service.

The same traffic can serve two different security purposes.

The SOC and the WAF must therefore understand the context correctly.

High traffic to a login endpoint may be;

a credential attack,

a bot attack,

layer 7 DDoS,

or genuine user demand.

Each requires a different response.

What Is Slowloris?

Slowloris is an application layer DoS approach that tries to hold connections on the web server open for a long time.

The aim is not to send very high traffic.

A connection is opened to the server but completion of the request is delayed as long as possible.

The server keeps allocating resources to the connection.

With enough connections, the connections available to genuine users can dwindle.

This approach shows why layer 7 attacks cannot be measured by RPS alone.

What Is Slow POST?

In slow POST attacks the HTTP request body can be sent very slowly.

The server holds the connection open waiting for the request to complete.

Meanwhile worker or connection resources are consumed.

Controls such as;

connection timeout,

request timeout,

minimum data rate

are therefore important on application servers.

How Are Botnets Used for Layer 7 DDoS?

Botnets are not used only for volumetric attacks.

Large numbers of compromised devices can also send normal HTTP requests.

The attack can then come;

from different IPs,

from different countries,

from clients resembling genuine browsers.

This reduces the effectiveness of simple IP rate limiting.

Because even if each bot generates low-intensity traffic, the total can create serious load.

What Is Low and Slow Layer 7 DDoS?

Rather than sending hundreds of thousands of requests per second, some attackers use large numbers of bots at a low request rate.

Each bot may send;

a few requests per minute.

From a single user's perspective the behaviour looks normal.

But tens of thousands of bots together can strain the application.

This approach can be assessed as low and slow DDoS.

It is hard to detect because classic rate thresholds may never be exceeded.

How Is Bot Traffic Distinguished from Genuine Users?

This is one of the hardest issues in layer 7 DDoS defence.

Genuine users use HTTP.

Bots use HTTP.

Several signals must therefore be assessed together.

Characteristics such as;

request frequency,

navigation behaviour,

cookie support,

JavaScript execution,

browser fingerprint,

session duration,

mouse interaction,

URL sequence,

IP reputation

can be analysed.

This approach can be called behavioural bot detection.

What Is Bot Management?

Bot management is the security approach aimed at separating automated traffic from genuine user behaviour.

Not all bots are bad.

For example;

search engine crawlers,

monitoring bots,

partner integrations

can be legitimate.

But;

scraping bots,

credential stuffing bots,

DDoS bots

can be malicious.

The aim is therefore not to block all bots but to recognise malicious automation.

What Is Browser Fingerprinting?

Browser fingerprinting means building a profile from client signals such as;

browser characteristics,

operating system,

TLS behaviour,

header structure,

JavaScript features.

This approach can help detect malicious bots.

But privacy and false positive considerations must be taken into account.

What Is TLS Fingerprinting?

In HTTPS traffic, certain behaviours can be inferred from the client's TLS handshake characteristics without seeing the encrypted content directly.

This approach is known as TLS fingerprinting.

Particular automation tools or bot frameworks can show similar TLS behaviour.

These signals can help in layer 7 DDoS and bot detection processes.

But they should not be used as a definitive decision mechanism on their own.

JA3 and Similar Fingerprint Concepts

Various fingerprinting approaches have been developed to classify TLS client behaviour.

These methods turn the client's TLS handshake characteristics into a particular fingerprint.

Telemetry of this kind helps SOC and WAF systems understand automation behaviour.

But modern bots can imitate fingerprint behaviour.

Using multiple signals is therefore important.

What Is Rate Limiting?

Rate limiting restricts the number of requests accepted for a particular client or behaviour.

For example, limits such as;

10 logins per second for one IP,

100 API requests per minute for one user,

5 search requests per second for one session

can be applied.

It is one of the most fundamental controls in layer 7 DDoS defence.

But the right threshold must be set.

The Difference Between Global and Endpoint Rate Limits

Global Rate Limit

A general traffic limit for the whole application.

Endpoint Rate Limit

A separate limit set for a particular URL or API function.

In layer 7 security, endpoint-based rate limiting is usually more meaningful.

Because /static and /login do not share the same risk profile.

What Is User-Based Rate Limiting?

Using IP-based limits alone is not always enough.

Rate limits can instead be applied by;

user ID,

session,

API key,

device identifier.

This approach reduces the chance of genuine users behind NAT or a proxy being blocked by mistake.

What Is Adaptive Rate Limiting?

Adaptive rate limiting applies dynamic limits according to traffic behaviour rather than a fixed threshold.

If normal traffic is 100 requests per second and rises to 500, a different policy can be applied.

But during a campaign period the normal baseline may already be 1,000 requests.

The system can therefore assess historical and current behaviour together.

This approach provides more flexible protection in layer 7 DDoS defence.

How Does a WAF Block Layer 7 DDoS?

A web application firewall (WAF) can help detect layer 7 attacks by analysing HTTP/HTTPS traffic.

A WAF can assess information such as;

the URI,

the method,

headers,

cookies,

the session,

request rate,

client reputation.

For suspicious behaviour, actions such as;

blocking,

rate limiting,

a challenge,

JavaScript verification

can be applied.

But the WAF must be tuned correctly.

Otherwise genuine user traffic is affected too.

Is a WAF Enough on Its Own?

No.

A WAF is an important part of layer 7 defence.

But the application's backend architecture must be resilient too.

Suppose the WAF passes 10,000 requests per second.

The application server can process only 2,000 of them.

The bottleneck in that case is the application.

Layer 7 security must therefore be thought of as;

WAF + application architecture + rate limiting + cache + scaling + monitoring

working together.

How Does a CDN Help Against Layer 7 DDoS?

A CDN can serve cacheable content from edge points.

That reduces the load on the origin.

For example;

images,

CSS,

JavaScript,

static pages

can be answered without reaching the origin.

But dynamic endpoints such as login or APIs still have to go to the origin.

A CDN therefore strengthens the layer 7 defence but does not solve the whole problem.

How Does Caching Improve DDoS Resilience?

Caching prevents the same data being regenerated by the backend over and over.

Rather than running a database query on every request for the same product page, the cache can be used.

That reduces backend resource consumption during a layer 7 attack.

But the attacker can use different query strings or random URLs to bypass the cache.

Cache behaviour must therefore also be assessed in DDoS testing.

What Is a Cache Busting Attack?

The attacker can try to force a cache miss by using a different query parameter on every request.

For example:

/product?id=100&x=1

/product?id=100&x=2

/product?id=100&x=3

requests like these can bypass the cache mechanism.

This behaviour can be thought of as cache busting.

The result is that every request reaches the origin and the database.

CDN and cache policies must therefore be configured correctly.

Does CAPTCHA Stop Layer 7 DDoS?

CAPTCHA can help separate automated bots.

But it is not suitable in every situation.

Because;

it degrades the user experience,

it can create accessibility problems,

advanced bots can defeat some CAPTCHA systems.

CAPTCHA should therefore not be the main DDoS defence on its own.

It is better used as an adaptive challenge mechanism for risky traffic.

What Is a JavaScript Challenge?

Some edge security platforms use a JavaScript challenge to assess whether the client is a genuine browser.

A real browser can solve the challenge.

Simple bots fail.

But JavaScript cannot be used in API traffic.

Different methods are therefore needed for API DDoS defence.

Does an API Key Provide DDoS Protection?

An API key helps identify the client.

That allows;

per-key rate limiting,

quotas,

anomaly detection

to be applied.

But if the API key is compromised, the attacker can abuse the service with a valid key.

An API key must therefore be used together with;

authentication,

rate limits,

behaviour analytics.

Why Are Unauthenticated APIs Riskier?

Public APIs may have no user identity.

Rate limiting is then based more on;

IP,

device,

token,

fingerprint.

In a distributed botnet attack each of these signals can be inadequate on its own.

Strong bot and abuse detection is therefore important for public APIs.

The Relationship Between Layer 7 DDoS and the Database

The real target of many application layer attacks may be the database rather than the web server.

The attacker heavily uses the search endpoint, for instance.

Each request creates a heavy query on the database.

The web server is still up.

But database CPU reaches 100%.

The result is that the whole application slows down.

Database telemetry must therefore also be monitored in layer 7 DDoS monitoring.

What Is Connection Pool Exhaustion?

Application servers use a limited number of connections to the database or other backend services.

This resource is called the connection pool.

Under heavy request load the pool can fill entirely.

New genuine user requests cannot obtain a backend connection.

That affects application availability.

Connection pool usage must therefore be monitored alongside CPU and memory.

What Is Thread Pool Exhaustion?

Some application servers use a limited number of workers or threads to process incoming requests.

Long-running or expensive requests can consume all of those resources.

New requests then start queueing.

This can be assessed as thread pool exhaustion.

Layer 7 DDoS attacks can target these resources directly.

Why Is a Timeout a Security Control?

A timeout is not merely a performance setting.

It can prevent a request consuming resources indefinitely.

For example;

HTTP timeout,

database query timeout,

backend API timeout

must be defined.

Otherwise slow or malicious requests can occupy resources for long periods.

A resilient application architecture is therefore an important part of DDoS security.

What Is a Circuit Breaker?

In microservice architectures, when a downstream service fails, other services continuously sending requests to it can cause a cascading problem.

The circuit breaker approach can temporarily halt calls to a failing service at a defined error threshold.

The risk of cascade failure is thereby reduced.

In layer 7 attacks it can prevent not only the target service but the services depending on it from failing too.

What Is the Bulkhead Pattern?

The bulkhead approach separates an application's resources between different services or operations.

The aim is that a service under excessive load should not consume the whole application's resources.

This architectural principle is valuable for DDoS resilience.

Because it makes it harder for an attacker to bring down the entire platform through a single endpoint.

Does Autoscaling Solve Layer 7 DDoS?

Autoscaling can create new application instances when traffic rises.

That is useful for availability.

But if the attacker keeps increasing the traffic, the system keeps scaling.

Costs can then grow rapidly.

Autoscaling is therefore not protection on its own.

Whether the traffic is malicious must also be determined.

What Is EDoS?

Economic denial of sustainability (EDoS) describes an approach, particularly in cloud environments, where the attacker raises costs to unsustainable levels rather than bringing the system down entirely.

Bots send heavy requests.

The cloud platform keeps autoscaling.

The service stays up.

But the monthly cloud bill multiplies.

DDoS security must therefore be considered for cost resilience as well as technical availability.

How Is Layer 7 DDoS Detected?

Network bandwidth alone is not enough for layer 7 detection.

These metrics matter more:

Requests Per Second (RPS)

Endpoint Request Distribution

HTTP Status Codes

Response Time

Session Behavior

Cache Hit Ratio

Backend CPU

Database Load

Connection Pool

Error Rate

This telemetry shows whether application behaviour has deviated from normal.

What Does a Rise in HTTP 5xx Mean?

When backend resources are exhausted during a layer 7 DDoS attack, server-side error codes such as;

500,

502,

503,

504

can rise.

In particular:

503 Service Unavailable

can be an important signal of load or service exhaustion.

But not every rise in 5xx is DDoS.

It can also be an application bug or an upstream problem.

It must therefore be analysed together with the traffic context.

Why Is Response Time a Critical Metric?

A system usually starts slowing down before it goes fully down.

Normal response time may be:

200 ms

while during the attack it becomes:

2,500 ms

instead.

Technically the system may still be responding.

But the user experience has been seriously degraded.

In DDoS resilience testing, therefore, not only uptime but service quality must be measured.

How Does a SOC See Layer 7 DDoS?

The SOC can correlate signals from different sources.

For example;

a WAF request increase,

application response time,

5xx errors,

bot score,

CDN events,

API gateway telemetry

can be assessed together.

Coordination between application and security teams matters particularly in layer 7 attacks.

Because the network can look normal.

The first to notice the problem may be the application monitoring system.

How Is a SIEM Used for Layer 7 DDoS?

A SIEM can correlate data from sources such as;

the WAF,

the CDN,

the API gateway,

application logs,

NDR,

the firewall.

For example:

an RPS increase on a particular endpoint,

a bot reputation alert,

a backend CPU increase,

a rise in 5xx errors

can all be parts of the same attack event.

Correlations of this kind help the SOC understand a layer 7 attack faster.

Why Does APM Matter for DDoS Security?

Application performance monitoring (APM) monitors the application's backend performance.

It provides data such as;

transaction latency,

database query time,

service dependencies,

error rate.

During a layer 7 DDoS attack, APM can reveal application bottlenecks the network security system cannot see.

APM data is therefore valuable in DDoS operations too.

How Is a Layer 7 DDoS Test Carried Out?

In an authorised DDoS resilience test, layer 7 scenarios can be applied in a controlled way.

First;

the critical endpoints,

normal RPS,

maximum accepted RPS,

the response time SLA,

stop conditions

are determined.

The test traffic is then increased gradually.

At each stage the behaviour of;

the WAF,

the CDN,

the application,

the database,

the SOC

is monitored.

The aim is not to stop the service uncontrollably but to find the safe thresholds.

What Should Be Measured in a Layer 7 DDoS Test?

A professional test must answer these questions:

Did the WAF see the attack?

When did rate limiting engage?

Was bot traffic detected?

Were genuine users blocked?

How much did application response time rise?

At what level was the database strained?

Did the CDN reduce origin load?

How long did the SOC take to see the alert?

How long did the service take to return to normal after mitigation?

These measurements are what give the test its real value.

What Is the Biggest Mistake in Layer 7 DDoS Protection?

One of the biggest mistakes is relying on the WAF alone.

The WAF may be strong.

But if;

the backend architecture,

the database,

the cache,

the API design,

rate limiting

are weak, the attack can still succeed.

Equally, the application may be very strong while the WAF blocks genuine users because of a wrong threshold.

Layer 7 defence must therefore be thought of end to end.

Corporate Layer 7 DDoS Defence Architecture

A general architecture can be thought of as follows:

Internet

↓

CDN / Edge Protection

↓

Bot Management

↓

WAF

↓

Rate Limiting

↓

Load Balancer

↓

Application

↓

Cache

↓

Database / Microservices

Every layer should reduce the attack load.

But no layer should be treated as unlimited.

The Relationship Between Layer 7 DDoS and Business Continuity

A layer 7 attack can look small from the network team's perspective.

The attack may be only:

80 Mbps

in volume.

But if the payment API is entirely unusable, the business impact is enormous.

In DDoS risk assessment, therefore, business service impact rather than technical traffic volume must be the basis.

A 100 Gbps attack can be filtered successfully.

But a 50 Mbps application attack can halt the sales system.

Which is more critical?

The answer depends on the business impact.

Conclusion: The Biggest DDoS Attack Is Not Always the One Sending the Most Traffic

Layer 7 DDoS attacks are one of the most critical availability risks facing modern digital services.

Because the attacker does not have to get past network security.

They can use valid HTTP requests.

They can establish valid HTTPS connections.

They can resemble a genuine browser.

They can use a low traffic volume.

But when the right endpoint is targeted, critical resources such as;

CPU,

the database,

the thread pool,

the connection pool,

the authentication service,

the API backend

can all be consumed.

Layer 7 DDoS security should therefore not be measured only by the question:

“How many Gbps of attack can we withstand?”

These questions must be asked too:

How many RPS can we handle?

Which is the most expensive endpoint?

Can the WAF separate the attack from genuine users?

How effective is bot management?

Are the API rate limits correct?

At which threshold does the database become the bottleneck?

When does genuine user response time degrade?

How many minutes does the SOC take to see it?

Layer 7 resilience can only be understood by testing network security, application architecture and security operations together.

And that brings us to the next critical question in DDoS security:

How does an organisation actually measure how much attack it can absorb?

Knowing the attack type alone is not enough.

At what level does the service degrade?

At what threshold does mitigation engage?

Where does the first bottleneck form?

The answers emerge from DDoS resilience testing and capacity analysis.