{"id":13331,"date":"2021-01-05T13:21:44","date_gmt":"2021-01-05T10:21:44","guid":{"rendered":"https:\/\/www.hyyat.com\/docs\/what-is-a-slowloris-ddos-attack\/"},"modified":"2026-10-21T20:02:32","modified_gmt":"2026-10-21T17:02:32","password":"","slug":"what-is-a-slowloris-ddos-attack","status":"publish","type":"docs","link":"https:\/\/www.hyyat.com\/en\/knowledgebase\/what-is-a-slowloris-ddos-attack\/","title":{"rendered":"What Is a Slowloris DDoS Attack and How to Protect Your Server"},"content":{"rendered":"
\n
In short<\/b>Slowloris is a \u201cslow\u201d denial of service attack: instead of flooding the server with traffic, the attacker opens hundreds of connections and keeps them alive by sending the request a tiny piece every few seconds, until the server runs out of connections and real visitors cannot get in. Defences: per-address connection limits, a short request timeout, a web server that does not tie up a process per connection, and cloud protection.<\/div>\n
\"Slowloris<\/figure>\n

How does the attack work?<\/h2>\n

When someone visits your site, their browser sends a complete HTTP request in a fraction of a second. In Slowloris the attacker sends only the start of the request, then one small extra line every 10 or 15 seconds, so the request never completes. The server assumes a slow visitor and keeps the connection open, waiting.<\/p>\n

    \n
  1. The attacker opens hundreds of connections:<\/b> Sometimes from a single machine, with very little bandwidth.<\/li>\n
  2. Keeps them alive slowly:<\/b> Each connection sends a small piece just before the server\u2019s timeout.<\/li>\n
  3. The server runs out of connections:<\/b> Web servers that reserve a process per connection hit their limit.<\/li>\n
  4. Real visitors are turned away:<\/b> The site looks down while CPU and bandwidth stay almost idle.<\/li>\n<\/ol>\n

    Signs of the attack<\/h2>\n