How to protect a hidden service against DDOS attack? I did some research and found that it is possible to do load balancing with HAProxy. Is there any other solution that could be implemented?

  • The same like in clearnet.
    – krang
    Jan 12, 2014 at 13:30
  • Check this Blog Torproject New Tor Denial of Service Attacks and Defenses
    – krang
    Jan 26, 2014 at 12:44

1 Answer 1


A DDOS attack is a type of cyber-attack that uses multiple compromised systems to target a single system, such as a server or website. The goal of the attack is to make the targeted system unavailable by flooding it with requests from the attacking systems.

There are many ways to protect a hidden service against DDOS attack. One way is to use an anti-DDoS service like Cloudflare, which provides protection for both HTTP and HTTPS traffic. Another way is to use an anti-DDoS solution like Incapsula, which provides protection for HTTP traffic only. .If your hidden service is not using an anti-DDoS solution like Cloudflare, Incapsula, or Sucuri Security the most important thing you can do is to enable a rate limit on the server. In other words, the server should only accept a certain number of requests per second. .Why are there limits on the number of requests per second?As mentioned in the previous question, it is important to limit the number of requests per second for security reasons. If a hidden service gets DDOSed and it does not have a rate limit, then anyone can make an unlimited number of requests and overwhelm the server. . .

How do I set up a rate limit for my hidden service? .-- If you are using port 80, then you can use the standard Apache httpd configuration file to enable a rate limit. For example, add this line in your Apache httpd configuration file: LimitRequestBody 1000000.-- If you are using port 443 (HTTPS), then you should use the mod_security module to limit request rates. For example, add this line in your mod_security configuration file: SecFilterEngine Off SecFilterRule \ "id:'1011' match => string:10 action => 'deny'SecFilterRule \ "id:'1012' match => string:10 action =>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.