How to protect a hidden service against DDOS attack? I did some research and found that it is possible to do load balancing with HAProxy. Is there any other solution that could be implemented?

  • The same like in clearnet.
    – user732
    Commented Jan 12, 2014 at 13:30
  • Check this Blog Torproject New Tor Denial of Service Attacks and Defenses
    – user732
    Commented Jan 26, 2014 at 12:44
  • See also serverfault.com/questions/987879/… Commented Dec 20, 2022 at 3:58
  • @krang Most Admins protect clearnet sites by giving their https private keys to a third party; I don't think that's going to work for security-critical Onion Services. Consider, for example, the Secure Drop site for the New York Times. That probably shouldn't be fronted by Cloud Flare security.stackexchange.com/questions/246542/… Commented Dec 20, 2022 at 4:26

2 Answers 2


A DDOS attack is a type of cyber-attack that uses multiple compromised systems to target a single system, such as a server or website. The goal of the attack is to make the targeted system unavailable by flooding it with requests from the attacking systems.

There are many ways to protect a hidden service against DDOS attack. One way is to use an anti-DDoS service like Cloudflare, which provides protection for both HTTP and HTTPS traffic. Another way is to use an anti-DDoS solution like Incapsula, which provides protection for HTTP traffic only. .If your hidden service is not using an anti-DDoS solution like Cloudflare, Incapsula, or Sucuri Security the most important thing you can do is to enable a rate limit on the server. In other words, the server should only accept a certain number of requests per second. .Why are there limits on the number of requests per second?As mentioned in the previous question, it is important to limit the number of requests per second for security reasons. If a hidden service gets DDOSed and it does not have a rate limit, then anyone can make an unlimited number of requests and overwhelm the server. . .

How do I set up a rate limit for my hidden service? .-- If you are using port 80, then you can use the standard Apache httpd configuration file to enable a rate limit. For example, add this line in your Apache httpd configuration file: LimitRequestBody 1000000.-- If you are using port 443 (HTTPS), then you should use the mod_security module to limit request rates. For example, add this line in your mod_security configuration file: SecFilterEngine Off SecFilterRule \ "id:'1011' match => string:10 action => 'deny'SecFilterRule \ "id:'1012' match => string:10 action =>


You can use EndGame, which was a system designed to protect Onion Services from DDoS attacks.

In May 2020, Onion Ltd released EndGame on GitHub. It uses nginx frontend proxies ("fronts") to put the users in queues and require them to solve a CAPTCHA (generated with python).

After waiting some seconds, the user is presented with a CAPTCHA from one of the fronts. If the user solves the CAPTCHA correctly, then their session is forwarded to the actual Onion Service backend.

If the CAPTCHA works, then the DDoS will be mitigated against the backend, and the Onion Service administrator only needs to scale-up their fronts. EndGame's README recommends at least 3 fronts.

At the time of writing, EndGame is what's used in many popular Onion Services, such as the Elude Tech Collective and the Dread Forums.

EndGame's README says that it helps mitigate DDoS attacks, but that it "isn't perfect" and suggests that the Tor developers add a POW at the introduction point to make Onion Services more DDoS resilient

EndGame isn't perfect. It can't protect against introduction cell type attacks (the Tor project will need to add POW at the introduction points to fix that). But it does provide good protection and scaling which makes it much harder to take you down overall for whatever people throw at you.

source: https://github.com/onionltd/EndGame/blob/master/README.MD

Further Reading

For more information about protecting Onion Services from DDoS attacks, see the following articles published by the Tor Project:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .