Peakhour.IO - Rate Limiting

Residential Proxies Turn Layer 7 DDoS Into a Route Problem

AC — Sat, 01 Aug 2026 12:20:00 +1000

A distributed pool can keep each residential IP quiet while expensive application routes fail. Mitigation has to follow request cost and behaviour, not only traffic volume.

Five Routes, Five Residential Proxy Decisions

AC — Sat, 01 Aug 2026 12:10:00 +1000

Account creation, login, password reset, checkout, and public APIs should not share one residential-proxy action. Each route needs its own evidence and failure policy.

The IP Changed. Did the Actor?

AC — Sat, 01 Aug 2026 11:20:00 +1000

Residential proxy rotation defeats IP-only counters. The answer is not a new identity claim, but a carefully chosen set of cohort, account, route, and outcome keys.

Residential Proxy Detection for APIs Without JavaScript

AC — Sat, 01 Aug 2026 11:10:00 +1000

APIs cannot depend on browser JavaScript to expose proxy abuse. They need server-side network, protocol, identity, route, and outcome evidence in the request path.

How to Protect APIs From Unwanted Automation

AC — Wed, 29 Jul 2026 00:00:00 +1000

An API cannot simply block automation. The practical job is to decide which automated use belongs on each route, then control the rest without breaking legitimate clients.

Using Network Fingerprints in Bot and Rate-Limit Decisions

AC — Mon, 13 Jul 2026 09:28:00 +1000

A practical way to use network fingerprints for bot and rate-limit decisions without mistaking a shared client cohort for identity.

An Operating Model for API and Account Protection

AC — Fri, 19 Jun 2026 00:00:00 +1000

API and account protection works best as an operating model: map routes, classify signals, choose proportionate actions, preserve evidence, and tune controls from monitor to enforce.

API Bot Abuse Does Not Stay in One Endpoint

AC — Fri, 19 Jun 2026 00:00:00 +1000

API bot abuse moves across login, checkout, and account journeys. Defenders need route-aware bot, rate, and account controls that follow the campaign rather than treating each endpoint as a separate incident.

API Protection and Account Protection Are One Request-Path Problem

AC — Fri, 19 Jun 2026 00:00:00 +1000

Account protection does not stop at the login form. The same request path carries API, bot, rate, token, and account-risk evidence, and that is where the decision needs to happen.

How Residential Proxies Changed API and Account Abuse

AC — Fri, 19 Jun 2026 00:00:00 +1000

Residential proxies have changed account abuse from obvious bursts into distributed, low-noise workflows across login, account, and API routes. Treat proxy use as a risk signal, not a blunt block rule.

Beyond the IP Address

AC — Mon, 01 Sep 2025 00:00:00 +1000

Discover why traditional IP-based rate limiting is obsolete and how advanced techniques provide robust protection against modern distributed attacks.

The Bot Spectrum

AC — Mon, 01 Sep 2025 00:00:00 +1000

Learn to classify bots into good, bad, and grey categories and apply the right management strategy for each.

Rate Limiting for API Security

AC — Wed, 24 Jan 2024 13:00:00 +1100

How advanced rate limiting protects modern applications and APIs from sophisticated threats including proxy networks, distributed attacks, and automated abuse in enterprise security environments.

RFC 9460

AC — Thu, 16 Nov 2023 00:00:00 +1100

Introducing SVCB and HTTPS records in DNS and their impact on web connectivity.

HTTP/2 Rapid Reset Attack Deepdive

AC — Thu, 12 Oct 2023 00:00:00 +1100

The technicalities of the HTTP/2 Rapid Reset vulnerability and steps to fortify against DDoS threats.

Understanding the HTTP/2 Rapid Reset Attack

AC — Wed, 11 Oct 2023 00:00:00 +1100

A comprehensive breakdown of the HTTP/2 Rapid Reset flaw and guidance on bolstering defences against potential DDoS attacks.

ZDNS - scan the entire internet

AC — Tue, 20 Jun 2023 13:00:00 +1000

Details the use of ZDNS, a high-performance DNS toolkit, to create a comprehensive Reverse DNS (rDNS) lookup database by scanning the entire internet, and how randomizing the IP space overcomes UDP timeout issues.

Enterprise DDoS Protection

AC — Mon, 19 Jun 2023 00:00:00 +1000

Analysis of the Microsoft 365 DDoS attack by Storm-1359 reveals critical lessons for enterprise application security platforms. Learn advanced Layer 7 DDoS protection strategies and rate limiting techniques for modern applications.

Understanding HTTP Link Headers

Dan — Wed, 24 May 2023 13:00:00 +1000

How HTTP Link headers move preload, preconnect, and related resource hints into the response headers, plus the cases where that is operationally useful.

Consistent Hash with Bounded Loads

AC — Mon, 15 May 2023 13:00:00 +1000

An overview of consistent hashing with bounded loads, an advanced load balancing technique that ensures a more even distribution of keys across servers, preventing overload and improving system stability.

Multi-Origin Load Balancing

Dan — Tue, 11 Apr 2023 13:00:00 +1000

Websites with a global audience need more than just a traditional CDN. They need geographic multi origin load balancing.

Introducing Automatic Cache Tags in the Updated Peakhour WordPress Plugin

Dan — Mon, 20 Mar 2023 13:00:00 +1100

Read about automatic cache tags in the updated Peakhour WordPress plugin.

Layer 7 DDoS Protection

AC — Tue, 07 Feb 2023 13:00:00 +1100

Comprehensive guide to Layer 7 DDoS protection using strategic caching within application security platforms. Learn how intelligent caching strategies provide robust defence against sophisticated application-layer attacks.

Automatic Image Optimisation

AC — Tue, 06 Dec 2022 13:00:00 +1100

Image optimisation saves you bandwidth and designer effort while reduces page load time.

Drupal full page caching module

Dan — Wed, 05 Oct 2022 13:00:00 +1100

We're excited to announce our Drupal 8/9 caching module, read on for more details.

IP Threat Intelligence

AC — Fri, 15 Jul 2022 13:00:00 +1000

Comprehensive guide to IP threat intelligence for modern application security platforms. Learn how managed IP reputation lists and threat intelligence feeds protect applications from known malicious sources and emerging threats.

CVE-2022-26134

AC — Thu, 02 Jun 2022 00:00:00 +1000

Peakhour clients are protected against CVF-2022-26134 Atlassian Confluence RCE

Intelligent Rate Limiting

AC — Mon, 16 May 2022 13:00:00 +1000

Comprehensive guide to intelligent rate limiting for modern application security platforms. Learn how sophisticated rate limiting protects APIs and web applications from abuse, DDoS attacks, and automated threats whilst maintaining optimal user experience.

Rate limiting

AC — Mon, 16 May 2022 13:00:00 +1000

How can rate limiting protect your web application and the key items to consider when enabling.

Request collapsing

AC — Mon, 16 May 2022 11:00:00 +1000

Request collapsing - saving your origin by reducing concurrent requests and re-using responses for resources.

Cdn-Cache-Control

AC — Mon, 28 Feb 2022 13:00:00 +1100

CDN-Cache-Control is a proposed new header to augment the venerable Cache-Control. Its aim is to make controlling caching easier as CDNs become ubiquitous.

Cache-Status

AC — Fri, 25 Feb 2022 13:00:00 +1100

Cache-Status is a proposed standard header to provide visibility into how caching providers interact and handle a request.

Website Optimisation

Dan — Mon, 17 May 2021 13:00:00 +1000

Even if you have the fastest server in the world, your website might still seem very slow to end users if you have lots of render blocking resources, learn how to deal with them.

Secure Dynamic Content Caching

Dan — Tue, 09 Feb 2021 13:00:00 +1100

Comprehensive guide to secure dynamic content caching that improves server performance whilst maintaining security controls. Learn how modern application security platforms integrate caching with threat protection for optimal performance-security balance.

Common Issues That Affect Website Performance

Dan — Mon, 30 Nov 2020 13:00:00 +1100

After covering testing we're going to get an overview of the common issues that impact website load times and how to check for them.

Test Your Website Performance With Google Lighthouse

Dan — Mon, 14 Sep 2020 13:00:00 +1000

Use Lighthouse to reproduce a page-load test, read the metrics behind its score and turn failed audits into specific performance work.

Application Performance Optimisation

Dan — Sat, 12 Sep 2020 13:00:00 +1000

A practical primer for finding where website requests lose time, from cache state and origin work to browser rendering.

WordPress Performance Optimisation

Dan — Mon, 27 May 2019 13:00:00 +1000

How to speed up WordPress by separating public cacheable pages from private, expensive, and abused request paths.

Boost Your Website Speed with Peakhour's Full Page Caching

Dan — Tue, 02 Apr 2019 13:00:00 +1100

Experience a significant boost in website speed and performance with Peakhour's Full Page Caching feature, now easily accessible through our Wordpress plugin.