> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/reference/web-ddos-mitigation-reasons.md). # Web DDoS Mitigation Reasons As described below, Web DDoS evaluates requests based on a number of factors. As anomalies accumulate, the "Sumpoints" value rises. If Sumpoints becomes too large, requests are blocked. Below is a list of anomalies/errors that will trigger DDoS mitigation.

Type	Error(s)/Algorithm(s)	Explanation
Invalid HTTP Request	STATS_NEVERSTARTEDHEADER STATS_HTTPUNKNOWNMETHOD STATS_HTTPNOVER STATS_HTTPNOTV1 STATS_TRASHAFTERCRLFCRLF STATS_ZEROBYTEINHEADER STATS_HTTPMISSINGCONTENTLENGTH STATS_ALREADYHASXDDOSPROXY STATS_HTTPEMPTYREQUEST STATS_HTTPONHTTPS	An 'Invalid HTTP Request' error message can occur for a variety of reasons, and the most common ones include issues related to header submission, HTTP verb usage, HTTP version compatibility, content-length header, and protocol mismatch. The client made a connection but did not submit a header within 32 seconds The client provided a HTTP verb that is not known The client performed a request without an HTTP version The client performed a request without HTTP/1. version against an HTTP1.x endpoint The client performed a request that contained data after the header ended The client performed a request without header end marker or without line end The client failed to provide a content-length header, although one is required The client performed an HTTP request against an HTTPS port
Policy Violation	STATS_BIGHEADER STATS_HTTPREFERERWOHTTP STATS_HTTPLONGREQUEST STATS_HTTPLONGUSERAGENT STATS_HTTPLONGREFERER STATS_HTTPLONGHOST STATS_HTTPLONGCOOKIEHEADER STATS_HTTPUNKNOWNHOST STATS_HTTPBLACKLISTEDHOST STATS_HTTPSMALLREFERER STATS_HTTPLONGRANGE STATS_HTTPBIGBODY STATS_HTTPLISTENIP	When a client's request violates a policy, it means that the request made by the client falls outside of our internal guidelines. This could be due to a number of reasons: The client performed a request with an abnormally large header. The client performed a request containing a referer without proper protocol specification. The client requested a URL longer than the maximum configured request size (which can be configured by support). The client performed a request containing a user-agent longer than the configured maximum user-agent size (which can be configured by support). The client performed a request containing a referrer longer than the configured maximum referrer size (which can be configured by support). The client performed a request containing a host header longer than the configured maximum host header size (which can be configured by support). The client performed a request containing a cookie header longer than the configured maximum cookie header size (which can be configured by support). The client performed a request containing a range header longer than the configured maximum range header size (which can be configured by support). The client performed a post request exceeding the configured maximum post size. The webddos proxy connection was accessed via its IP address. The whitelist is enabled but the IP is not on the whitelist. The blacklist is enabled and the IP is on the blacklist. The client performed a request containing a very short referrer.
Uncommon HTTP Profile	STATS_SLOWHEADER STATS_NOACCEPTENCODINGHEADER STATS_NOUSERAGENTHEADER STATS_NOACCEPTHEADER STATS_SMALLHEADER STATS_NOREFERERHEADER STATS_HTTPREFERERWOURI STATS_HTTPLOTSOFRANGES STATS_HTTPHEAD STATS_HTTPREST STATS_HTTPOPTIONS STATS_HTTPPROPFIND STATS_HTTPDELETE STATS_HTTPPUT STATS_HTTPRANGEHEADER STATS_HTTPREFERERONEDOT	An "Uncommon HTTP Profile" can indicate a variety of things: The client started submitting a header but did not finish within 10 seconds. The client performed a request missing an Accept-Encoding header. The client performed a request missing a User-Agent header. The client performed a request missing an Accept header. The client performed a request containing a very small header. The client performed a request containing a referer without a URI. The client performed a request containing lots of range headers. The client performed a HEAD request. The client performed a REST request. The client performed an OPTIONS request. The client performed a PROPFIND request. The client performed a DELETE request. The client performed a PUT request. The client performed a request containing a Range header. The client performed a request containing a referer which in turn contains an invalid URI.
Uncommon Visitor Profile	STATS_HTTPSAMEURL STATS_HTTPUSERAGENTSDIFFER STATS_HTTP3xSPACEINUSERAGENT STATS_HTTPUSERAGENTLOWERCASE STATS_HTTPUSERAGENTUNCOMMON STATS_HTTPONLYPOST STATS_GEOIPBAD	An “Uncommon Visitor Profile” typically indicates that the client is not a human. Uncommon visitors are often identified by: Spaces in the User Agent fully lowercase User Agent strings fully uppercase User Agents strings Uncommon or rarely user User Agent strings Making POST requests over HTTP
Very High Traffic Source	STATS_HITS_PER_SECOND_DROPPED STATS_HITS_PER_SECOND STATS_HITS_PER_SECOND_EXCEEDED	The reasons for a "Very High Traffic Source" is due to the client exceeding 25 hits per second.
Local Policy Violation	STATS_GEOIPNOTALLOWED STATS_BLACKLISTEDIP	IPs that are blacklisted either via countryrRestrictions or an explicit blacklist
Mitigation Challenge Failed	STATS_MISSINGLDPCCOOKIE STATS_RECAPTCHA_STARTED STATS_RECAPTCHA_FAILED STATS_RECAPTCHA_TOKEN_INVALID STATS_HTTPINVALIDLDPCCOOKIE	This is provided to the client when they are unsuccessful in one or more mitigation strategies, such as when they have an invalid or missing ldpc cookie or when they fail the recaptcha test.