Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

I use Heroku as my hosting solution. So, if some bad man attacks my site with DDoS, what should I do?

share|improve this question

migrated from stackoverflow.com Apr 26 '10 at 12:30

This question came from our site for professional and enthusiast programmers.

marked as duplicate by Tom O'Connor Aug 25 '13 at 9:34

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
@TomOConner- NOT a dup- this question is Heroku specific –  Yarin Feb 9 at 15:23

2 Answers 2

Heroku is a "platform as a service," not a typical hosting solution. A denial of service attack against your site would be an attack against the entire platform. Heroku takes security seriously and presumably has sophisticated measures in place to detect and mitigate DDOS attacks.

Sit back and relax. On a platform like Heroku, your job is to develop and maintain the security of your own code, while leaving management of the platform to the provider.

share|improve this answer
1  
Wish this were true, but this blog post describes how Heroku failed to prevent a DoS attack, responding that "Heroku does not offer any kind of direct DDoS mitigation unfortunately". We're currently experiencing a similar issue on Heroku where we're getting repeat automated requests from an IP (though it seems accidental rather than malicious) and have no way to block it. Tough to "sit back and relax" in that situation. –  Yarin Feb 9 at 15:30
    
This is interesting. It should be noted that as of today, "advanced DDoS mitigation controls" are an advertised feature of Heroku. If they truly did respond in the way that the author describes, they were not doing their job, and my reaction would have been very similar. –  Skyhawk Feb 10 at 20:05

Make regular back-ups :)

Your host should guard against this already, but there are scripts and tools that you can install that supposedly work.. http://www.blockdos.net/

share|improve this answer
2  
BlockDOS won't help if the traffic is saturating your internet connection. All that is is an IDS and firewall. To stop a DDoS affecting your system, you need to blackhole the traffic higher up in the routing. –  Tom O'Connor Apr 26 '10 at 13:25