---
description: Understand automatic DDoS attack mitigation.
title: DDoS Protection
image: https://developers.cloudflare.com/og-docs.png
---

[Skip to content](#main-content)

> Documentation Index  
> Fetch the complete documentation index at: https://developers.cloudflare.com/learning-paths/llms.txt  
> Use this file to discover all available pages before exploring further.

# DDoS Protection

Last updated Aug 25, 2026|Copy as Markdown|[View as Markdown](https://66f4ea29.previews.developers.cloudflare.com/learning-paths/application-security/default-traffic-security/ddos/index.md)|[Agent setup](https://66f4ea29.previews.developers.cloudflare.com/agent-setup/)

Cloudflare automatically detects and mitigates DDoS attacks using its [Autonomous Edge](https://66f4ea29.previews.developers.cloudflare.com/ddos-protection/about/components/#autonomous-edge), which is always-on. `Advanced` protections are reserved for Magic Transit customers.

| OSI Layer   | Ruleset / Feature                                                                                                                                                              | Example of covered DDoS attack vectors                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| L3/4        | [Network-layer DDoS Attack Protection](https://66f4ea29.previews.developers.cloudflare.com/ddos-protection/managed-rulesets/network/)                                          | ACK floodsBitTorrent reflection attackCarpet Bombing attacksCHARGEN reflection attacksDNS amplification attackDNS Garbage FloodDNS NXDOMAIN floodDNS Query floodDTLS amplification attacksESP floodGRE floodsICMP flood attackJenkins amplification attacksLantronix reflection attacksmDNS DDoS attacksMemcached amplification attacksMirai and Mirai-variant L3/4 attacksMSSQL reflection attacksNetBios DDoS attacksOut of state TCP attacksProtocol violation attacksQUIC flood attackQuote of the Day (QOTD) reflection attacksRST floodSIP attacksSNMP flood attackSPSS reflection attacksSSDP reflection attacksSYN floodsSYN-ACK reflection attackTeamSpeak 3 floodsUbiquity reflection attacksUDP flood attackVxWorks DDoS attacksFor more DNS protection options, refer to [Getting additional DNS protection](https://66f4ea29.previews.developers.cloudflare.com/ddos-protection/about/attack-coverage/#getting-additional-dns-protection). |
| L3/4        | [Advanced TCP Protection](https://66f4ea29.previews.developers.cloudflare.com/ddos-protection/advanced-ddos-systems/overview/advanced-tcp-protection/) [1](#user-content-fn-1) | Fully randomized and spoofed ACK floods, SYN floods, SYN-ACK reflection attacks, and other sophisticated TCP-based DDoS attacks                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| L7 (DNS)    | [Advanced DNS Protection](https://66f4ea29.previews.developers.cloudflare.com/ddos-protection/advanced-ddos-systems/overview/advanced-dns-protection/) [1](#user-content-fn-1) | Sophisticated and fully randomized DNS attacks, including Water Torture attacks, Random-prefix attacks, and DNS laundering attacks.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| L7 (HTTP/S) | [HTTP DDoS Attack Protection](https://66f4ea29.previews.developers.cloudflare.com/ddos-protection/managed-rulesets/http/)                                                      | Cache busting attacksCarpet Bombing attacksHTTP Continuation floodHTTP flood attackHTTP/2 MadeYouResetHTTP/2 Rapid ResetHULK attackKnown DDoS botnetsLOIC attackMirai and Mirai-variant HTTP attacksSlowloris attackTLS/SSL exhaustion attacksTLS/SSL negotiation attacksWordPress pingback attack                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |

## Footnotes

1. Available to Magic Transit customers. [↩](#user-content-fnref-1) [↩2](#user-content-fnref-1-2)

Refer to the learning path [Prevent DDoS attacks](https://66f4ea29.previews.developers.cloudflare.com/learning-paths/prevent-ddos-attacks/concepts/) to dive deeper into this subject.

Was this helpful?

YesNo

## On this page

[![](https://66f4ea29.previews.developers.cloudflare.com/_astro/logo.te5VL_aD.svg)Docs](https://66f4ea29.previews.developers.cloudflare.com/)

```json
{"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/learning-paths/application-security/default-traffic-security/ddos/#page","headline":"DDoS Protection · Cloudflare Learning Paths","description":"Understand automatic DDoS attack mitigation.","url":"https://developers.cloudflare.com/learning-paths/application-security/default-traffic-security/ddos/","inLanguage":"en","image":"https://developers.cloudflare.com/og-docs.png","dateModified":"2026-08-25","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}}
```
