Handling 1 Million Fake API Requests

What to Do If Your API Suddenly Receives 1 Million Fake Requests

If your API suddenly receives 1 million fake requests, your server slows down and logs flood. This is usually a DDoS attack or bot flood.

1. Put Protection in Front of Your Server (Most Important)

Use a CDN + Web Application Firewall (WAF) such as:

• Cloudflare
• AWS (Shield + WAF)
• Fastly

These services:

• Block bot traffic before it hits your server
• Rate-limit abusive IPs
• Detect DDoS patterns automatically
• Filter suspicious countries or networks

2. Enable Rate Limiting

Node / Express Example

const rateLimit = require('express-rate-limit');

app.use(rateLimit({
  windowMs: 60 * 1000,
  max: 100
}));

NGINX Example

limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;

server {
  location /api/ {
    limit_req zone=api_limit burst=20 nodelay;
  }
}

3. Block at Firewall Level

iptables -A INPUT -s 1.2.3.4 -j DROP

You can also use tools like fail2ban or CSF firewall.

4. Reduce Logging for Spam

location /api/ {
  access_log off;
}

Or configure logs to record only server errors (5xx).

5. Add CAPTCHA or Token Validation

• Require API keys
• Use JWT authentication
• Add CAPTCHA to public endpoints

6. Use Caching

• Redis
• CDN edge caching
• Reverse proxy caching

If responses are cached, the server workload is greatly reduced.

7. Enable Auto-Scaling (Cloud)

If hosted on AWS, Google Cloud, or Microsoft Azure:

• Enable auto-scaling groups
• Use load balancers
• Run multiple instances

Emergency Checklist

• Turn on CDN/WAF protection
• Enable strict rate limiting
• Block top offending IPs
• Disable heavy logging
• Add firewall rules

Recommended Production Setup

• CDN with WAF
• NGINX rate limiting
• API key requirement
• Redis caching
• Minimal logging