In 2026 a DDoS attack targeted our trading platforms. I led the response and the edge hardening that followed.
Context
In 2026 a DDoS attack targeted our trading platforms. I led the response and the edge hardening that followed.
My role
I led the incident response and the hardening work that followed, across the Cloudflare Enterprise edge.
Approach & trade-offs
- Edge caching to take load off the origin.
- WAF custom rules and client fingerprinting against malicious clients.
- Tiered rate limiting, tuned on real traffic rather than guesses.
- Zero Trust Access in front of an internal application.
Trade-off: not every rule was enforced, because some would have blocked legitimate traffic. Protecting real users took priority over a stricter rule.
A proactive audit of cache rules also found and fixed a misconfigured rule that was hurting the hit rate.
Results
- Absorbeda major traffic spike
- Nolegitimate traders blocked
- Highcache hit rates restored
Later, a major traffic spike hit the platform. The hardened edge absorbed it without blocking legitimate traders, and cache hit rates are high on both pages and static assets.
Lessons
- Stage protective rules and review real traffic before enforcing.
- Not every rule that can block should block. Weigh the false-positive cost against the threat.
- Caching is a security control: a well-cached edge absorbs attack traffic before it reaches the origin.
- Audit cache rules regularly. One bad rule can quietly erase most of your hit rate.
More case studies
- Cloud Cost Optimization at FundedNext: 65% Lower Cloud Costs Without Disrupting the Business
- Migrating 2.5 TiB and 12M+ Objects from DigitalOcean Spaces to Amazon S3 with Zero Copy Failures
Related service: Cloudflare edge security and rate limiting