DDoS Protection
DDoS protection at the server, not just at the edge
Most Magento sites end up behind Cloudflare. It's the path of least resistance — set up the DNS, enable proxying, switch on the WAF, done. For a lot of sites it's enough. But edge protection comes with its own costs: a network hop on every request, rules and decisions you can't see in detail without the Business plan, and a control surface that's the same for everyone on it. The moment something gets serious — a coordinated scrape, a targeted attack, a competitor's bot army — the gaps in that setup start to matter.
luroConnect now ships DDoS protection directly at the host layer, with a control surface exposed through our UI. It's a managed service — luroConnect operates the rules; the UI is something the merchant or agency can use too.
What the rules engine can do?
The protection layer sits in front of Magento and decides, per request, whether to allow, challenge, or block. Decisions can be based on any combination of:
- Country / geographic region.
- ASN — the network the request is coming from, useful for blocking cloud providers being used as bot infrastructure.
- IP address or range.
- User agent.
- Bot signatures — known crawlers, scrapers, headless browsers.
These dimensions compose. You can say “block all traffic from these ASNs except requests from our monitoring partner's user agent” and it does the right thing.
Whitelist over blocklist. Whitelist rules win. If you whitelist a specific user agent — say, a partner's integration — and the country it's coming from is on the block list, the request still goes through. This matters more than it sounds. The default in most WAFs is the opposite, and the number of times that's caused a legitimate integration to silently break is not small.
Challenge instead of block. Instead of a hard 403, you can challenge suspect traffic. The challenge is a lightweight JavaScript-based human check — pass it, and the request continues; fail it, and you're out. This is friendlier than blocking for grey-zone traffic (suspicious but possibly legitimate) because real users get through with no visible friction while headless bots don't.
Live logs and the analyzer
The decision layer is built into nginx — specifically, an nginx build with ModSecurity for advanced WAF rules and njs for the request-time logic that drives the allow/challenge/block decision. ModSecurity gets its own post; this one is about the rules engine and what sits on top of it.
Every decision the engine makes is written to an nginx access log in a custom format that captures the things you'd actually want to look at later — the matched rule, the dimensions that triggered it, the action taken, the request signature — alongside the normal access log fields. Same log pipeline as everything else nginx serves, queryable by the same tools.
On top of that log stream sits an analyzer that aggregates per-minute: status code distribution, top IPs, top ASNs, top user agents, request rates per path, ratio of challenges to passes. Patterns surface as they form, not hours later. A burst of 4xx from a single ASN, a spike of /checkout traffic from one user agent, an unusual jump in challenges failing — these are visible in the minute they're happening.
The analyzer also alerts on patterns we've seen elsewhere across the fleet, and with permission acts on them automatically. A sudden surge from a single ASN can be flipped to auto-challenge before anyone needs to look at it. Where the merchant prefers human review, the same signal raises an alert instead. The point is that rules adjust in minutes — observation and response are part of the same loop.
What this means in practice?
For a merchant on luroConnect, the practical experience is: the rules already exist, tuned for the patterns we see across the fleet, and they adjust as new patterns emerge. If there's a specific concern — a known bad actor, a region you don't ship to, a partner integration that needs whitelisting — that's a conversation, not a project.
DDoS protection is one of those things that's invisible when it works and catastrophic when it doesn't. Putting it on the host, on an SLA, with rules powerful enough to actually shape traffic and observation tight enough to keep up — that's the bar we think it should clear.






















