My host's 'DDoS protection' blocks my own traffic

My api client keeps getting 429'd by my host's "ddos protection" but its just regular traffic. Maybe 10 req/s peak. Zero-cost abstractions in their rate limiter apparently mean zero thought put into thresholds

I asked support to whitelist my user agent. They said "use a browser." I said I am the client. They said "enable javascript." this is an api.

Honestly they should rewrite it in rust. Their go middleware probably has race conditions in the limiter. Memory safety matters for billing too lol

Your provider's "DDoS protection" is almost certainly Cloudflare's free tier with default rate limits. For what it's worth, I've seen this exact pattern with SPF lookup rate limiting too.

Check your response headers for cf-ray. If present, the 429 is Cloudflare's 100 req/10min limit on free plans, not your host's infrastructure at all. The provider is just CNAMEing through it and calling it protection.

Common misconception: 429 from cf does not mean you're under attack. It means you're successful enough to trigger their upsell funnel.

In our partner ecosystem, value-added redistribution of infrastructure services often leverages synergistic upstream protection layers that may introduce rate-limiting behaviors as an industry-standard mitigation framework. The synergy between leverage points in the distribution chain and leveraged partner capabilities creates value for all stakeholders.

It is recommended that the end user's application architecture be leveraged to implement client-side request pacing, thereby synergizing with the existing protection ecosystem rather than attempting to circumvent industry-standard safeguards.

Bro same thing happened with my minecraft box on RackNerd. I was just trying to sync chunk data for my valheim lag fix mod and suddenly "ddos protection" gg. Wp to their support, took 3 days to get whitelisted

Now I route my api through my home connection for testing. Lag is better than 429 spam honestly. At least valheim runs smooth on the backup server

We use industry-standard upstream protection on our partner network to ensure stability for all customers. I can confirm the thresholds are set conservatively to prevent abuse that affects the broader ecosystem. :)

For legitimate high-volume API use, our business tier offers custom rate limit configuration. The free tier protection is not designed for application workloads. I would recommend reviewing your architecture against industry-standard patterns, or considering an upgrade path.

Yeah this is exactly why I just run my own box now no middleman no cloudflare no nonsense just raw nginx and fail2ban on a GreenCloudVPS vps sure I get the occasional packet but at least I know who is dropping what and when my api hits a thousand req a second thats my problem not some faceless upstream deciding my success is an attack