Hardening
Server and platform hardening
These pages are about the servers, not about the protection device in front of them. Every one of them is a set of tunables and the commands that read and set them: which kernel parameter governs the accept backlog, which directive bounds a slow request, which connector setting decides what happens when the thread pool is full.
The honest ceiling is stated on every page and it is the same one. Host hardening raises the floor — it decides whether a mid-sized flood is an incident or a graph — and it does nothing whatever about a saturated circuit. When the pipe is full, the packets never reach the parameter you tuned.
Values are given as starting points to be measured against your own traffic, not as settings to paste. A limit that protects one workload starves another, which is why every page also says what to watch after the change and how to back it out.
Start here
Linux Server DDoS Hardening: Every sysctl, conntrack and nftables Setting
Every sysctl and nftables tunable, its value and its check
nginx DDoS Hardening: Connection Limits, Rate Zones and Timeouts by Directive
Rate zones, connection limits and timeouts by directive
Linux Network Stack Tuning for DDoS: NIC Queues, RSS/RPS and XDP
NIC queues, packet steering, IRQ affinity and XDP
Go deeper
Technical depth · Last updated August 2026
HAProxy DDoS Hardening and Tuning
HAProxy sits where connection-level abuse arrives first. Stick tables for per-source rate tracking, the timeout set that answers slow-HTTP attacks, and the connection limits that decide whether a flood is an incident or a graph.
Technical depth · Last updated August 2026
Kubernetes Ingress DDoS Hardening
Ingress controller rate limits and connection ceilings, why autoscaling under attack often just increases the bill, and the resource limits that stop one overloaded pod taking a node with it.
Technical deep dive · Last updated August 2026
Apache DDoS Hardening: MPM Choice, mod_reqtimeout and Per-IP Limits
Apache's DDoS resilience is decided first by MPM choice — prefork is exposed to Slowloris, event is not — and then by mod_reqtimeout, mod_qos and mod_evasive. Every directive with its value, its module and its verification.
Technical deep dive · Last updated August 2026
IIS DDoS Hardening: Dynamic IP Restrictions, Request Filtering and App Pool Queues
IIS sits above http.sys and defends at the application layer: Dynamic IP Restrictions for per-source rate and concurrency, Request Filtering for size limits, and the application-pool queue and rapid-fail protection. Every setting in web.config and appcmd, with its counter.
Technical deep dive · Last updated August 2026
JBoss / WildFly DDoS Hardening: Undertow Listener Limits and IO Threads
On JBoss EAP and WildFly the DDoS surface is the Undertow subsystem: listener connection and timeout limits, the IO-worker thread split, and request-size caps, all set through the CLI. Every attribute with its value, its jboss-cli command and its counter.
Technical deep dive · Last updated August 2026
Tomcat DDoS Hardening: Connector Thread Pools, Timeouts and the Front Layer
Tomcat's DDoS exposure is set by its Connector: maxThreads, acceptCount, maxConnections and the timeouts. The single largest decision is not exposing Tomcat directly — every server.xml setting with its value and its counter, and why a front layer comes first.
Technical deep dive · Last updated August 2026
WebLogic DDoS Hardening: Work Managers, Message Timeouts and Overload Protection
WebLogic's self-tuning thread pool changes the DDoS approach: you set Work Manager constraints, the Complete Message Timeout against slow requests, and the Overload Protection actions, all through WLST. Every setting with its MBean, its value and its counter.
Technical deep dive · Last updated August 2026
Windows Server DDoS Hardening: What Still Needs Tuning and What the OS Already Handles
Most Windows DDoS hardening advice is a list of registry keys that modern Windows Server manages automatically and that you should not touch. What actually matters: the TCP autotuning templates, Windows Filtering Platform rate rules, http.sys queue behaviour and adapter RSS.