My Droplet got flooded with requests overnight. What should I do now, and how do I prepare for next time?

Question

Last night my site went down for about an hour. I checked the Nginx access log and saw thousands of requests per minute from a lot of different IPs, mostly hitting the same page. CPU was at 100% and the Droplet stopped responding until the traffic dropped.

I only have Nginx and a basic Cloud Firewall that allows ports 22, 80 and 443. I am not sure if this was a real DDoS or just a bad bot. What should I check first, and what is a sensible setup so this does not take my site down again?

Bobby · Answer

Hi there, First, work out what you are dealing with. This shows the top IPs, the top pages, and the top user agents in your log: awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -20 awk '{print $7}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10 awk -F'"' '{print $6}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10 A few IPs sending most of the traffic is a bad bot, and you can block them. Thousands of IPs hitting one page with the same user agent is a distributed flood. In both cases the fix below is the same, so you don’t need a perfect diagnosis to start. My recommendation is four steps, in this order: Put Cloudflare in front. The free plan is enough. Turn on the proxy for your DNS record. It absorbs most of the junk before it reaches your Droplet. If you are under attack right now, “Under Attack Mode” is a quick temporary switch. Lock your Droplet to Cloudflare. Right now your Cloud Firewall allows 80 and 443 from everywhere, so an attacker can skip Cloudflare and hit your IP directly. Change the 80 and 443 rules to allow only Cloudflare’s IP ranges . While you are there, limit port 22 to your own IP. Add rate limiting in Nginx: http { limit_req_zone $binary_remote_addr zone=perip:10m rate=10r/s; server { location / { limit_req zone=perip burst=20 nodelay; } } } Once you are behind Cloudflare, Nginx will see Cloudflare’s IPs instead of the real visitors. Set up the real_ip module with Cloudflare’s ranges, or this limit will hit the wrong addresses. Also remember that per-IP limits help less when the traffic comes from thousands of IPs, so this is a second layer, not the main one. Cache the page being hit. If the flood targets one page, Nginx can serve it from cache instead of running your app every time. Even a 10 second microcache cuts the load a lot. A Cloud Firewall filters by port and source, and it cannot rate limit. Deny rules can block a few bad IPs, but they don’t scale to thousands. For next time, install the DigitalOcean monitoring agent and set a CPU alert at 80%, so you find out before the site goes down. If you want to see how these attacks work and why each layer helps, this DDoS attack simulator shows the different attack types and protections in your browser.

alexdo · Answer

Hi there, Bobby’s four steps are the right fix, Cloudflare plus locking the firewall to it, nginx rate limiting with real_ip, and microcaching the hot page. One thing worth adding, since you asked whether this was a real DDoS or just a bad bot: DigitalOcean already gives every Droplet automatic DDoS protection at no cost, active from the moment you provision it, with no setup needed. It just does not reach what hit you. That protection covers network and transport layer attacks, volumetric floods and SYN floods, the kind of traffic that tries to saturate your connection or exhaust connection state before anything reaches Nginx. What you described, thousands of requests per minute against one page from many IPs, pegging CPU, is an application layer (layer 7) flood, and DigitalOcean’s own documentation is explicit that layer 7 is outside what this protection covers. So you were not unprotected last night, the protection you already had just was not built to catch this particular shape of attack. That is exactly the gap Cloudflare’s proxy and Bobby’s Nginx config close, rather than something layered on top of nothing. Regards

Become a contributor for community

DigitalOcean Documentation

Resources for startups and AI-native businesses

The developer cloud

Start building today

Report this

My Droplet got flooded with requests overnight. What should I do now, and how do I prepare for next time?

Related questions

Why does my Node.js app use way more memory in production than in local testing?

How do I handle duplicate and retried webhooks safely on my Droplet?

What Ubuntu packages and services should I check before deploying to a fresh Droplet?

Mysql Data disappears intermittently

What is the best way to send automated email reports from a Python script on a Droplet?

How does SMTP actually work, and why do my emails keep ending up in spam?

Self-hosting observability for your AI agents on a $6 Droplet

Best way to securely access a homelab remotely without relying only on Tailscale?

VLESS VPN connects but no traffic passes through (DigitalOcean VPS + x-ui + Xray)

Nodemailer stopped working after migrating from shared hosting to a DigitalOcean Droplet

New account with GitHub Student Pack credits cannot create Droplets or use Launchpad

What’s the status of CopyFail patches in shared hosts?

Report this

My Droplet got flooded with requests overnight. What should I do now, and how do I prepare for next time?

Related questions

Why does my Node.js app use way more memory in production than in local testing?

How do I handle duplicate and retried webhooks safely on my Droplet?

What Ubuntu packages and services should I check before deploying to a fresh Droplet?

Mysql Data disappears intermittently

What is the best way to send automated email reports from a Python script on a Droplet?

How does SMTP actually work, and why do my emails keep ending up in spam?

Self-hosting observability for your AI agents on a $6 Droplet

Best way to securely access a homelab remotely without relying only on Tailscale?

VLESS VPN connects but no traffic passes through (DigitalOcean VPS + x-ui + Xray)

Nodemailer stopped working after migrating from shared hosting to a DigitalOcean Droplet

New account with GitHub Student Pack credits cannot create Droplets or use Launchpad

What’s the status of CopyFail patches in shared hosts?