Targets advanced bots and application-layer attacks that attempt to mimic legitimate user behavior. VergeCloud offers three challenge modes:

Cookie Challenge

1. Ensures the browser can accept and return cookies
   
2. Stops simple bots
   
3. Lightweight and user-friendly
   

JS Challenge

1. Requires the browser to execute a small JavaScript file for validation
   
2. Stops bots that cannot execute JavaScript
   
3. Ideal for preventing automated scraping or credential stuffing
   

Captcha Challenge

1. Displays an image- or puzzle-based Captcha
   
2. Provides the highest verification level
   
3. Best suited for login pages, checkout flows, or sensitive user actions
   

TTL (Time-To-Live) determines how long a successfully validated challenge remains trusted.

• Long TTL results in fewer repeated challenges and a better user experience

• Short TTL provides stronger security but may introduce more frequent prompts

For example, if TTL is set to 30 minutes, a user who passes a challenge will not be prompted again for the next 30 minutes.

How to Implement an Effective DDoS Strategy

You should avoid challenging every user and instead focus on suspicious or abusive traffic. A progressive strategy helps balance security and usability.

A. Limit Abusive IP Addresses 

Best Practices for JS and XHR Under DDoS Mitigation

If example.com loads JavaScript that makes requests to sub.example.com, credential-included requests may be required when challenges are active.

Fetch example: fetch("https://sub.example.com", { credentials: 'include' });

XHR example: let xhttp = new XMLHttpRequest(); xhttp.open("GET", "https://sub.example.com", true); xhttp.withCredentials = true; xhttp.send();

Ajax example: $.ajax("https://sub.example.com", { xhrFields: { withCredentials: true }});

CORS and Preflight Notes

If the subdomain does not need to return a response:

fetch("https://sub.example.com", { mode: 'no-cors', credentials: 'include' });

Note on images: Any images included in this article should use clear, descriptive alt text to ensure accessibility and improve clarity for all users.

Summary

VergeCloud’s DDoS protection offers multi-layer filtering across L3/4 and L7, configurable challenge modes, firewall-based bot mitigation using IPs, user agents, JA3 fingerprints, and rate limits, along with flexible TTL controls and exclusion rules. Built into a secure CDN, this approach allows you to stop attackers effectively while preserving a smooth experience for legitimate users. By combining traffic analytics, adaptive challenges, and precise firewall controls, you can maintain availability even under sustained attack conditions.