Read the Docs fought off a 5.5M-request-per-minute DDoS

Read the Docs took 5.5 million requests per minute during a DDoS attack in mid-to-late June, against a normal baseline of around 100,000. The attack ran nearly ten days, sourced from millions of unique IPs spread across hundreds of networks.

For any site running a CDN in front of dynamic infrastructure, the target matters more than the size. The attackers skipped the homepage and went after uncached URLs, things like 404 pages and 302 redirects, because those bypass the cache and hit origin servers directly. A flood of cache misses costs far more to absorb than a flood of cache hits, and most sites don't bother caching pages that are supposed to be rare.

Every request came with randomized HTTP headers and TLS parameters. Per Read the Docs' post-mortem, two years of AI scraper traffic taught attackers how to do this. Plug an AI-built scraper into a proxy network and the output looks like organic readers spread across the globe, not a botnet.

No single fix stopped it. The team started edge-caching error pages so 404s stopped reaching origin. They added TLS-anomaly fingerprinting to flag handshakes that didn't match a real browser. Bot probability scoring came next. Dynamic redirects moved to Cloudflare edge workers, so they get served without touching the backend at all.

The post-mortem doesn't say what the attack cost in infrastructure spend or engineering hours, and it doesn't attribute the traffic to a specific group or motive. It documents the shape of the attack and what stopped it, nothing about who sent it or why.