All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Built My own L7 anti-DDoS system — looking for suggestions to improve it ! !
It’s an L7 HTTP/HTTPS protection layer that sits between Cloudflare and the origin server.
I originally built it for our own infrastructure, mainly to deal with HTTP floods, abusive bots, scrapers, and application-layer attacks.
Right now it includes:
Cookie / JS / interaction challenges
Automatic attack escalation + recovery
Rate limiting
Requests and Bandwidth realtime monitoring per second
Speed limiting rules per (path, extension,domain, subdomain) connection or total
Temporary bans / strike system
Managed bot/client blocklists
Lockdown mode
IP, CIDR, UA and path allowlists
Origin health monitoring
Per-domain caching
Traffic / attack visibility
Bandwidth monitoring
Webhook + email alerts
Protected subdomains
DNS stays behind Cloudflare orange-cloud, while Citadel handles filtering and proxying before traffic reaches the origin.
I’m considering turning it into a public service as well, but it’s still pretty new, so I’m sure there are bugs, edge cases, and attack patterns we haven’t run into yet.
would love to know your thoughts if you constantly deal into this
What would you expect from something like this? What would you change, and what are we missing?
If there’s interest in actually testing it, I can check with the @Mods to make it accessible
Comments
Vibe-coded?
Used AI but I used to sell Anti-DDos pre AI era as well so i know the ins and out
IDK if it can be said vibe-coded or not, you can try testing it maybe