Read the Docs Weathered the Largest DDoS Attack in Its History

Read the Docs has published a breakdown of the largest DDoS attack in the project's history. It hit in the second half of June 2026 and lasted almost ten days. At its peak, the infrastructure was taking in more than 5.5 million requests per minute — roughly a hundred times the normal load.

How This Attack Differed from Earlier Ones

Read the Docs has always been tolerant of bots and scrapers, and in the past ordinary IP-based rate limiting was enough to handle the problem. But over the last two years traffic from AI crawlers has grown sharply, and the June attack turned out to be more than ten times more powerful than anything the service had ever faced.

What set it apart was that it was truly global: requests came from millions of unique addresses across hundreds of networks worldwide — from residential blocks as well as hosting providers. The attackers randomized their HTTP headers and TLS parameters, evading signature-based filters (JA3/JA4), and deliberately targeted addresses that would miss the cache: nonexistent pages (404) and temporary redirects (302). Whenever the defenses reacted, the botnet changed the rhythm and paths of its requests, probing the boundaries.

The “Yo-Yo” Tactic

The attackers used a scheme in which the load would ramp up until it tripped the limits, then drop off to let the rate-limiting windows expire. This pattern is designed to inflate the bill for autoscaling infrastructure as much as possible and to cause periodic outages. At one point a simple Nginx redirect, which normally withstands thousands of requests per second, began dropping requests under the strain.

What Helped

Read the Docs flatly admits it: without Cloudflare, fending off the attack would have been impossible. Even so, they declined to use “Under Attack Mode,” which serves a JavaScript challenge to every visitor — it would have broken API integrations and gotten in the way of hundreds of thousands of live readers.

The team bet on layered defense. The key role was played by aggressive caching — even brief caching of redirects and 404 errors robs attackers of their foothold. Instead of IP blocking, which proved useless against distributed attacks, they introduced a “penalty box”: suspicious browser fingerprints, ASNs, or entire domains were rate-limited if they generated too many “expensive” responses such as redirects and 404s. The filtering rules were described through Terraform, which made it possible to test them quickly and safely.

A separate principle was to always leave a live user an “emergency exit”: the most a real person faces is a JavaScript challenge, after which they're left alone for about a day.

Takeaway

The authors underscore an unpleasant trend: as AI tools and proxy networks make attacks like this cheaper, they cease to be the lot of large corporate targets and become an everyday reality for any prominent public service. Read the Docs' infrastructure has grown more resilient, but background traffic from the same blocks is still visible, and the company sees the lull as a breather rather than the end of the story.

Source: Hacker News