Infrastructure
DDoS Protection for Web3 Projects: What Actually Works
Why Web3 front-ends and RPC endpoints face DDoS risk on top of, not instead of, standard web infrastructure risk.
LOZULA Senior Security Research Team
2026-07-21
6 min read
Key Takeaways for Security Teams
- RPC and indexer infrastructure is a DDoS target that is frequently left unprotected while the website gets a CDN.
- Expensive queries can exhaust an RPC endpoint at request volumes far lower than a traditional volumetric attack.
- Redundant RPC providers prevent a single endpoint failure from becoming full application downtime.
A Web3 project has two separate DDoS surfaces to defend: the standard web front-end, and the RPC/API infrastructure connecting users to the chain, and the second one is frequently left unprotected.
The Two Surfaces to Protect
Teams often secure one and forget the other exists.
- •The public-facing website and application, standard Layer 3/4 and Layer 7 DDoS territory
- •RPC endpoints and indexer/API infrastructure, which can be exhausted with expensive queries even at moderate request volume
Practical Mitigations
Most of what works here is standard infrastructure hygiene applied deliberately to the parts teams tend to skip.
- •Put a CDN/WAF in front of the front-end with rate limiting tuned to real usage patterns
- •Rate-limit and cost-limit RPC endpoints by API key, not just by raw IP
- •Use a managed or redundant RPC provider setup so a single endpoint outage does not take the whole app down
- •Monitor for abnormal query cost patterns, not just raw request volume