# DDoS Protection for Ecommerce and APIs: Edge, Origin and Ownership > Liam from Amen Security · 2026-11-07T00:50:51.230Z · cybersecurity · ddos · ecommerce · api · origin-security DDoS protection for ecommerce and APIs should cover edge filtering and controlled origin access. Agree critical request paths, safe rule testing, incident decision owners and exclusions in writing. An edge subscription alone is not a readiness plan, and a review does not establish a guaranteed uptime result. This is a buying checklist, not an assessment of your environment, a service commitment or legal advice. Scope at a glance Area What you should ask for Request path Edge filtering → approved origin access Customer workflows Check checkout, authentication and APIs Operations alongside the path Agree escalation, change approval and rollback owners Scope summary by Amen Security. Not an assessment of your environment or a service guarantee.What do recent DDoS numbers mean for an online store? [Cloudflare's October 29, 2026 report](https://blog.cloudflare.com/ddos-threat-report-2026-q3/) covers July through September on its own network. It says 96 percent of network-layer attacks ended in under ten minutes and 98 percent stayed below one gigabit per second. Canada moved up in the report's ranking of targeted locations. Read that for what it is: one vendor's telemetry. It doesn't measure every attack on the Internet, your odds of an outage or Amen customer outcomes, and it isn't this week's news. The useful takeaway is simple. Plan for a short burst, not just the record-breaking attack. And remember that not every slowdown is an attack. Your team still has to tell malicious traffic apart from a busy sale day or an application bug before anyone changes production. What is origin exposure in DDoS protection? Origin exposure is when the server behind a CDN or WAF can still be reached directly, for example by its IP address, so attackers can bypass edge filtering and hit the origin itself. That's why you start with a map. Write down the domains, public endpoints, edge configuration and origin access the review includes. Mark the paths the business can't lose: checkout, login, customer APIs. Then ask the provider which controls your edge platform already gives you and which tasks stay with your hosting or application teams. Otherwise you end up comparing a software subscription with a configuration-and-operations engagement as if they were the same thing. Amen's public [Anti-DDoS protection page](https://amensecurity.ca/en/services/anti-ddos) lists edge filtering at L3, L4 and L7, WAF rules, rate limiting, CDN caching, origin hardening and exposure cleanup, and it describes the problem of an exposed origin sitting beside a CDN. Those service categories justify asking about the whole path. They are not proof that every feature is in a quote for your environment. How should you lock down the origin without breaking things? Origin hardening doesn't mean slamming every port shut. Ask which direct access is genuinely needed, which sources should be allowed and how management access stays controlled. What you want is a documented, authorized path. Not a firewall change nobody wrote down and nobody can reverse. Have your infrastructure owner read the proposal before anything is implemented. Amen's service description mentions closing direct-to-IP access, restricting management ports and reviewing exposure. It also says CDN/WAF configuration can sit over your existing hosting, with hosting as a separately scoped option. So ask plainly: can the provider make origin changes, does your host have to approve them, and who coordinates? Buying protection doesn't hand over every hosting responsibility. How should DDoS rules be tested on checkout and APIs? Before any rule goes live, the review should identify representative customer and machine workflows. Ask how rate limits and challenges will be checked against checkout, integrations and APIs, and what evidence gets recorded. Name a rollback owner. Define what counts as unacceptable customer impact before you need the definition. Amen describes rules aligned to real traffic shape, with controlled tests before and after changes, plus monitoring, alert thresholds and post-incident traffic review. That makes testing and evidence fair topics to raise. The exact test method, access permissions and monitoring commitment still belong in the written scope; a feature list doesn't set staffing or response terms for your contract. Who makes the calls during a DDoS incident? Edge and origin are parts of the request path. The playbook runs alongside it: who confirms the signal is real, who approves a change, which team handles hosting and how affected users are told. Ask who can make decisions outside business hours, and how responsibilities are handed back once things calm down. Amen lists uptime and failover playbooks, escalation clarification and post-incident reports, and it explicitly rejects a fake unlimited-bandwidth guarantee. Be as careful about exclusions as about inclusions. Application fixes, hosting capacity and other security projects shouldn't quietly become assumed deliverables. You're after a scope you can review, not an implied promise that the site can never go down. DDoS protection buyer checklist for ecommerce and APIs Use these questions to compare written proposals side by side. Edge, origin and operational responsibilities Area Question Evidence to request Edge Which WAF/rate-limit work is in scope? Configuration evidence and test plan Origin Which approved paths remain reachable? Exposure review and owner Operations Who approves changes and escalation? Written playbook; agreed coverage Exclusions Are hosting, application fixes and capacity separately scoped? Written exclusions and responsible owners Frequently asked questions What is origin exposure in DDoS protection? Origin exposure is when the server behind a CDN or WAF can still be reached directly, for example by its IP address, letting attackers bypass edge filtering and hit the origin itself. Must Amen host the website to review protection? No. The public Anti-DDoS page says Amen can configure the CDN/WAF over existing hosting; hosting is a separate scoped option. Does a protection review guarantee uptime? No. A review and this buying checklist do not establish a guaranteed uptime result. Commitments must be read in the written scope and agreement. How should DDoS rules be tested on an ecommerce site? Identify representative checkout, integration and API workflows first, check proposed rate limits and challenges against them, record the evidence, and name a rollback owner with an agreed definition of unacceptable customer impact. Article sources [Amen Security: Anti-DDoS protection](https://amensecurity.ca/en/services/anti-ddos) [Cloudflare, DDoS threat report for 2026 Q3](https://blog.cloudflare.com/ddos-threat-report-2026-q3/) Want a second look at your edge and origin? Tell us which paths matter most and what you're worried about. [Contact Amen Security to scope an edge-and-origin exposure review](https://amensecurity.ca/en/contact). We'll confirm responsibilities, exclusions and next steps before any work is approved. ## Topic: Cybersecurity & compliance - [Main guide](https://amensecurity.ca/en/services/cybersecurity.md) - [Managed IT vs Break-Fix: Side-by-Side Comparison](https://amensecurity.ca/en/guides/msp-vs-break-fix.md) --- Source page: https://amensecurity.ca/en/blog/ddos-protection-ecommerce-api-edge-origin-review Markdown version for AI agents · Amen Security Email: info@amensecurity.ca Phone: +1 (204) 514-3536