> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/product-guides/web-ddos/introduction.md).

# Introduction

The Link11 Web DDoS Protection service blocks DDoS attacks on OSI Layer 7 (application layer).

{% hint style="info" %}
For DDoS protection on Layers 3 and 4, use Link11's [Network DDoS Protection](/product-guides/network-ddos-v3/introduction.md) service.
{% endhint %}

Customers can also add these optional capabilities:

* [**Zero Touch WAF**](/product-guides/zero-touch-waf/introduction.md) service for filtering malicious requests
* [**Bot Management**](/product-guides/bot-management/introduction.md) service for mitigating hostile bots

Other highlights of the Web DDoS service include:

* **Multiple instances** to handle high traffic volumes
* **Load-balancing** of cleaned traffic to multiple origins
* **Automated redirection** of http traffic to https
* **Client browser verification** (by [confirming client certificates](/product-guides/web-ddos/interface/instances/tls-settings.md#tls-verify-client))
* **Optional termination of http2** connections, converting to http1

## Architecture

The Link11 Web DDoS Protection service is deployed as a reverse proxy. 

* Incoming traffic is routed to Web DDoS via DNS entries.
* Threat traffic is blocked.
* Cleaned traffic is forwarded to the customer origin(s).

In addition, customer networks should be configured to [ignore all traffic that is not arriving from Link11](/product-guides/web-ddos/faq/site-shield.md).

## Instances

The Web DDoS service consists of a single or multiple instances, where each of these instances receives a single public IP address provided by Link11 and shares the same configuration set. For example:

* TLS settings and x.509 certificate
* Load balancing and backend configuration
* WAF settings
* Error pages and maintenance mode

Web DDoS is mainly designed for HTTP applications and API's, but also features a TCP reverse proxy to route any TCP based protocol via the Link11 data centers.

***

## Threat assessment

The WebDDoS proxies analyze user behavior, and distribute points according to the character of that behavior.

{% hint style="success" %}
**Good points**:  

Requests act like humans and have negative numerical values (ex: -60). 
{% endhint %}

{% hint style="warning" %}
**Bad points**: 

Requests are not acting as expected and have positive numerical values (ex: +150)*.* 
{% endhint %}

These values are added up, and the resulting value is called **Sumpoints.** It indicates the nature of that traffic.

| Sumpoints Value                | Interpretation |
| ------------------------------ | -------------- |
| Sumpoints < -100.000           | **GOOD**       |
| -100.000 < Sumpoints < 100.000 | **OK**         |
| Sumpoints > 100.000            | **BAD**        |

{% hint style="info" %}
In a regular setup and with normal traffic, Sumpoints should be close to **0.** &#x20;
{% endhint %}

## Three modes of security posture

The Sumpoints are used in conjunction with general traffic trends and behavior to determine the current state or “mode” that the instance is in. The mode defines Link11's current behavior when processing traffic.

There are three possible modes:&#x20;

| Peace Mode                                                                                      | Suspicious Mode                                                                               | Attack Mode                                                                               |
| ----------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
| All traffic will be forwarded to the origin. No filters are used, and no packets are discarded. | The proxy looks at certain events more closely, and distributes points to anomalous requests. | Traffic that is deemed inappropriate, or that does not match normal patterns, is blocked. |

{% hint style="info" %}
While the current mode is (under normal circumstances) determined by Link11, it is also possible to [manually set Web DDoS into Attack Mode](/product-guides/web-ddos/interface/instances.md#trigger-attack-mode).&#x20;

It is also possible to [always block malicious IPs / GeoIPs / ASNs](/product-guides/web-ddos/interface/instances/ddos-mitigation.md), regardless of the current mode.
{% endhint %}