Itnetic TechnologiesLayer 7 in one minute
Networking is described in layers. Layers 3 and 4 move packets and connections; Layer 7 is the application itself — HTTP requests, page loads, API calls, form submissions. A Layer 7 DDoS attack speaks fluent HTTP: it requests real pages the way a browser would, but its only purpose is to exhaust your application.
That asymmetry is what makes L7 attacks efficient. Serving one search results page might cost your backend a database query, template rendering and several downstream calls — thousands of times more work than the attacker spent sending the request. The attacker does not need to saturate your bandwidth; a modest botnet politely requesting your most expensive endpoints will do. CMS platforms make the arithmetic worse still, because the expensive endpoints sit at the same URLs on every install — see how to protect WordPress from DDoS attacks.
Common Layer 7 attack patterns
- HTTP floods — high volumes of GET/POST requests to normal pages, distributed across a botnet so no single source stands out.
- Slow drips (low-and-slow) — attacks like Slowloris hold connections open with trickling requests, exhausting your server's connection pool with almost no bandwidth.
- Credential stuffing — automated login attempts using leaked password lists. Both an account-takeover attack and an application-layer flood on your auth endpoint.
- Cart and checkout abuse — bots that add items to carts or start fake checkouts, locking inventory and hammering the most expensive code paths in an online store. See how to protect an online store from DDoS attacks.
- Cache-busting floods — requests with randomized query strings crafted so every request misses your cache and hits the origin.
Layer 4 vs Layer 7 attacks at a glance
| Layer 4 attack | Layer 7 attack | |
|---|---|---|
| Target | Transport layer (TCP/UDP) | The application itself (HTTP) |
| Measured in | Gbps / packets per second | Requests per second |
| Looks like | Malformed or excessive packets | Legitimate browsing |
| Detected by | Volume thresholds, packet inspection | Behavioral analysis across requests |
| Stopped by | Network filtering, upstream capacity | Browser challenges, traffic baselines |
Why firewalls and volumetric defenses miss them
Traditional defenses ask "is this traffic malformed or excessive?" L7 attack traffic is neither. Each request is well-formed HTTP with plausible headers, often sent through real headless browsers at rates that look individually harmless. Signature-based firewalls find nothing to match; volumetric thresholds never trip because the attack may be only a few thousand requests per second — devastating for an application, invisible on a bandwidth graph. That gap between what a rule engine can see and what a flood actually is deserves its own explanation: WAF vs DDoS protection.
How Layer 7 mitigation actually works
Because single requests look clean, effective L7 defense examines behavior across requests: the rhythm of navigation, whether the client executes JavaScript and returns cookies like a real browser, whether request headers and TLS characteristics match the browser they claim to be, and whether traffic patterns to a host suddenly deviate from its baseline. Suspicious clients receive a lightweight, invisible browser challenge; real users pass without seeing a CAPTCHA, and bots that can't behave like browsers are cut.
API endpoints are the exception: machine clients cannot solve a browser challenge at all, so they are protected with identity and rate limits instead — covered in how to protect an API from DDoS attacks.
This behavioral approach is Itnetic's entire specialty — see how our Layer 7 DDoS protection applies it, or start with the fundamentals in What is a DDoS attack?