Skip to main content
DDoS Mitigation helps protect your web applications from Distributed Denial of Service (DDoS) attacks at the edge. Bunny Shield uses stateful request validation, behavioral analysis, and JavaScript Proof-of-Work (PoW) challenges to respond to suspicious traffic. A JavaScript PoW challenge asks the browser to complete a computational task. This helps validate the client, but adds an extra step for challenged users.

​
Monitoring mitigation activity

Use the DDoS page in your Shield zone to review aggregate mitigation metrics, including challenges and blocked sources. DDoS mitigation does not produce per-request entries in Shield Event Logs. The event logging API does not provide per-request DDoS records either.

​
Understanding blocked sources

A blocked source represents a source of traffic identified by Shield, such as an IP address, a JA4 fingerprint, or a combination of request characteristics. The metric counts blocked sources rather than individual requests. Source blocking can be triggered by different layers of Shield, including the WAF. You may therefore see blocked sources even when no DDoS challenges are shown, as other Shield protections can detect and block the traffic. For activity recorded by other Shield features, such as the WAF, use Shield Event Logs. Grouping by source IP can help you investigate related events, where available. These events can provide context, but they are not a complete record of DDoS mitigation and may not explain every blocked source.

​
Tuning sensitivity

DDoS sensitivity controls how aggressively Shield responds to suspicious traffic. Higher sensitivity makes mitigation more aggressive and can result in more clients being challenged, including legitimate users. Choose a level based on your application’s normal traffic and current conditions:
  • Review application availability, origin traffic, and error rates alongside aggregate DDoS metrics.
  • If suspected attack traffic continues to affect your application, consider increasing sensitivity and monitoring the result.
  • After each change, check that legitimate users and expected clients can still access your application.
A high blocked source count on its own is not a reason to increase sensitivity. Consider the impact on your application and the activity recorded by other Shield protections. DDoS sensitivity settings

​
Configuring via API

Use the Shield API to manage supported DDoS mitigation settings. See the API reference for available options.

Shield API Reference

Last modified on October 21, 2026