Problems / Security, medium
A strict WAF rule set blocks 4% of real users as attackers.
Free to open. Runs in your browser, no sign-up.
Success ≥ 99%.
1,500 requests a second for 30 seconds: 90% reads, 10% writes.
What each component does in this design, and what calls it. The simulator mimics each one from these settings.
| Component | Its job here | Settings |
|---|---|---|
| DDoS protectionDDoS protection | Traffic enters here.Calls WAF.Volumetric floods are absorbed at the network edge, spread over many locations, before they reach you. | 100000 slots |
| WAFWAF | DDoS protection forwards to it.Calls Bot management.A WAF inspects HTTP requests for attacks such as SQL injection and cross-site scripting. | 100000 slots |
| Bot managementBot management | WAF forwards to it.Calls Load balancer.Bot managers score clients by behaviour and fingerprint, not by IP address alone. | 100000 slots |
| Load balancerLoad balancer | Bot management forwards to it.Calls API.Layer 4 balancers route by IP and port; layer 7 balancers read HTTP and can route by path or header. | – |
| APIApp service | Load balancer forwards to it.Calls Postgres.Little's law: throughput ≈ concurrency ÷ latency. 200 slots at 50 ms serve about 4,000 req/s. | 4 replicas × 200 slots · timeout 2.0 s |
| PostgresSQL database | API calls it.Postgres runs one process per connection, which is why poolers like PgBouncer sit in front of busy databases. | 4 vCPU · 60 connections |
Try it first. Open one hint at a time if you get stuck.
Success is low but nothing is overloaded.
Look at “blocked real users” on the WAF.
Tune the WAF rules to cut false positives.