Layer 7 DDoS and origin fallback model
Availability is a product feature. Help4 Net is designed to keep pages loading during noisy traffic, bad bot surges, and partial POP instability.
Primary controls
- Request shaping and rate limits to absorb repetitive Layer 7 request floods.
- WAF policy filtering for abusive patterns before origin saturation.
- Health-aware routing so degraded POPs are removed from active delivery paths.
Your origin stays the source
The direct-origin model gives each POP an independent fetch path to your configured source IP and its own cache. HTTPS uses the correct origin hostname and certificate checks. A central POP is not meant to supply every other POP. Plugin uploads and control-plane coordination are separate concerns.
Protected routing recovery
- Direct first: a cache miss should reach the configured source from the serving POP.
- Qualified fallback: after a direct-path failure, a configured alternate path can use another healthy POP to reach that same source. Peer relays are failure-only paths, not the default origin.
- Visitor rerouting: for GeoDNS-enabled services, health-aware DNS can select another eligible POP for new connections. Fixed A-record services do not automatically include this behavior.
- Security stays in place: rerouting must retain WAF policy, origin access restrictions, trusted client-IP handling, and TLS verification. Unqualified or security-held POPs are not fallback candidates.
These are routing policies, not a guarantee that every fallback is available for every site. DNS caches and established connections can delay recovery. A session or live stream may need to reconnect. Safe retries must not replay application writes indiscriminately.
What routing cannot repair
If the source application, database, or every approved path is unavailable, another POP cannot create a healthy origin. Cache policy may allow eligible content to remain available; it cannot guarantee fresh content, successful logins, writes, or uninterrupted live sessions. We measure representative ISP paths without claiming that a small sample proves all networks work.
Operational objective
Reduce impact window, preserve site availability, and provide clear status visibility while mitigation is active. Continuous telemetry feeds post-incident tuning.