Name: DDactic Edge Protection Scorecard
Creator: DDactic
License: https://creativecommons.org/licenses/by/4.0/

The matrix

Scores at a glance

Cells are color-coded by score. Hover the column header for the dimension definition. ? means we have not run the test yet — usually because the vendor gates access behind enterprise contracts. Methodology and receipt paths are below the table.

3 Full 2 Strong / partial 1 Weak 0 Blind / unsupported ? Pending trial

Vendor	D1Tunnel compat	D2API control	D3L3/L4 API	D4Rate limit	D5Origin conceal	D6gRPC inspect
CloudflareCDN + WAF + Tunnel	2native (Tunnel)	3API v4 full parity	?Magic Transit gated	2sliding · per-IP+path strong sync · ~10 rpm	2Tunnel: 2 · CDN: 1	0Free tier: 403 at proto no method inspection
AWSWAF + CloudFront + Shield Advanced	?undocumented	3wafv2 full parity	2Shield Advanced API	1sliding · per-IP eventual sync · ~100 rpm	1CloudFront proxy	0464/502 · WAF Count did not fire on gRPC
AzureFront Door + Azure DDoS	?untested	2ARM API, some lag	?policy depth unverified	0fixed · per-IP eventual · ~200 rpm	?Private Link untested	0403 block at proto level
AkamaiKona / Bot Manager / Prolexic	?	?OPEN API, scope TBD	?Prolexic gated	?	?Site Shield TBD	?
ImpervaCloud WAF / DDoS	?	?	?	?	?	?pending trial #17
RadwareCloud WAF / Cloud DDoS / DefensePro	?	?	?DefensePro CLI/SNMP	?	?	?
Fastly+ Next-Gen WAF (Signal Sciences)	?	?VCL + Fastly API	?n/a (no L3/L4 product)	?	?	?
F5 Distributed CloudF5XC + Shape	?Private Connectivity	?	?n/a	?	?	?
Tailscale Funnelreference baseline	2	n/a	n/a	n/a	2	n/a
ngrokreference baseline	2	n/a	n/a	n/a	2	n/a

What we measure

The six dimensions

Each dimension corresponds to a real customer hardening decision. Scores are derived from public docs plus first-party lab testing. The internal spec is at docs/standards/VENDOR_SCORING_MATRIX.md.

Tunnel compatibility

Can the vendor sit in front of an origin reachable only through a private tunnel (Cloudflare Tunnel, Tailscale Funnel, ngrok) with no public listener? Native integration vs manual config vs unsupported.

0 unsupported 1 manual 2 native

API control completeness

How much of the vendor's protection config is reachable through a stable, documented API rather than dashboard-only? Drives whether DDactic can ship hardening as deployable change sets.

0 none 1 read-only 2 partial write 3 full parity

L3/L4 protection API

Whether volumetric / scrubbing controls (BGP, prefix protection, scrubbing policy, on-demand activation) are reachable through an API, and at what plan tier. Many vendors gate L3/L4 behind enterprise contracts.

0 dashboard-only 2 API @ standard tier

Rate limit counting

Window type (fixed / sliding / token bucket), counter scope, sync mode (per-PoP vs eventual vs strong distributed), and the minimum threshold below which the limit becomes unreliable. Azure Front Door is documented as unreliable below 200 req/min because of eventual consistency.

window · scope · sync · min-reliable

Origin concealment

What concealment posture the vendor enables. CDN proxy hides origin from users but historical DNS or CT logs can leak it. Tunneling removes the public listener entirely. We map vendor support to the OPI concealment tiers.

0 exposed 1 proxy only 2 tunnel native

gRPC inspection

Whether the vendor can inspect gRPC payload content at the method level, enforce per-method rate limits, block reflection probing, and handle h2c (cleartext HTTP/2) correctly. Three out of three major WAFs scored 0 in our lab.

0 blind 1 basic proxy 2 method-aware

How we test

Methodology and the receipts rule

The rule

No public claim ships unless a JSON artifact exists in data/ backing it.

Every "Tested" score on this page is backed by a measurement file you can audit. If you find a claim without a receipt, that is a bug — write to [email protected] and we will either produce the receipt or retract the claim.

How we run a test

Deploy a victim service behind the vendor edge using the vendor's documented reference architecture (no exotic config).
Run the dimension-specific harness against the public endpoint from DDactic load fleet IPs. No customer traffic, no shared infrastructure.
Capture response codes, timing, rule-fire signals, and any vendor-side telemetry visible to a customer.
Store the raw output as data/<lab>/<timestamp>_<vendor>_<pattern>.json.
Score only after the JSON exists. Update the matrix, link the artifact.

Audit trail

Receipts

Every measurement file lives in the DDactic research tree. The internal index is at docs/RESEARCH_INDEX.md; public artifacts are mirrored on request.

D6 — gRPC inspection (2026-05-11)

data/grpc_lab/2026-05-11_layer2_cf_utls.json # Cloudflare Free, gRPC 403 at proto level

data/grpc_lab/2026-05-11_aws_waf_findings.json # AWS WAF Count rules did not fire on any gRPC pattern

data/grpc_lab/2026-05-11_afd_findings.json # Azure Front Door 403 block on content-type

data/grpc_lab/2026-05-11_layer3*_cf_utls.json # CF layer-3 variants (utls, configservice, vanilla TLS)

data/grpc_lab/20260512T110731Z_origin_real-rpc_L3.json # direct-origin baseline

D2 + D4 — API behavior under load (2026-05-27 / 28)

data/api_lab/20260527T164755Z_cloudflare_deep-query.json

data/api_lab/20260527T165033Z_aws_waf_deep-query.json

data/api_lab/20260528T061209Z_cloudflare_rest_limit_abuse.json

data/api_lab/20260528T061226Z_aws_waf_cloudfront_rest_limit_abuse.json

data/api_lab/20260528T063910Z_cloudflare_graphql_depth_{15,50,100,200,500}.json # 5 depth variants

data/api_lab/20260528T063916Z_aws_waf_cloudfront_graphql_depth_{15,50,100,200,500}.json # 5 depth variants

data/api_lab/20260528T061300Z_cloudflare_auth_credstuff.json

data/api_lab/20260528T061317Z_aws_waf_cloudfront_auth_credstuff.json

data/api_lab/20260528T064016Z_cf_fingerprint_bypass_auth_credstuff.json # non-browser JA3, ~219 RPS sustained through CF Free

HTTP/2 + TLS abuse (2026-05-28)

data/api_lab/20260528T095405Z_http2_rapid_reset_{cf,aws_waf,direct_http,direct_https}.json # CVE-2023-44487 family

data/api_lab/20260528T095405Z_empty_tcp_hold_{cf,aws_waf,direct_*}.json

data/api_lab/20260528T095405Z_tls_reconnect_flood_{cf,aws_waf,direct_*}.json

data/api_lab/20260528T095405Z_tls_renegotiation_{cf,aws_waf,direct_*}.json

data/api_lab/20260528T095405Z_http2_tls_SUMMARY.json # roll-up summary

D1 + D5 — JS challenge / bot detection RE

docs/VENDOR_BOT_DETECTION_RE.md # 20-vendor JS reverse engineering

docs/challenge_re/*.md # per-vendor RE notes (F5 Shape, Akamai, Lumen, Fastly, Checkpoint, Gcore, Citrix, PerimeterX, DataDome, ...)

2026 research updates

Known gaps not captured in the six dimensions

The six dimensions above measure what we can test directly on free or trial tiers. The following gaps were identified in 2025–2026 peer-reviewed research and apply to the tested vendors regardless of their D1–D6 scores. Sources are linked where a publicly accessible paper exists.

IP-reputation scrubbing is blind to forwarder-sourced and blockchain-sourced amplification

Cloudflare, AWS CloudFront, Azure Front Door, OVH VAC, Hetzner. Transparent DNS forwarder amplification (CCS 2025, #40a) and Ethereum/Solana P2P amplification (SIGMETRICS/CCS 2025, #40c) both originate from legitimate IP addresses. IP-reputation blacklists and geofencing do not apply. Volume absorption continues, but the traffic is indistinguishable from normal ISP or blockchain node traffic at the scrubbing layer.

Pulse-wave attacks exploit scrubbing activation lag (OVH VAC, Hetzner, AWS Shield Standard)

OVH VAC and Hetzner Robot Firewall require 5–30 seconds to detect and activate scrubbing after a new pulse begins. AWS Shield Standard has a similar detection window. Each pulse in a pulse-wave campaign (#57) lands unmitigated before scrubbing activates. Enterprise fix: Akamai Prolexic always-on BGP diversion and Cloudflare Magic Transit with pre-provisioned rulesets have no activation delay.

Non-HTTP/S protocols fully exposed on all standard plan tiers

Cloudflare, AWS WAF, Azure Front Door, Fastly. SMTP (CoordMail state desync, NDSS 2026, #126a), MQTT (v5 request-response amplification, ICC Workshops 2026, #136a), and DNS amplification via transparent forwarders (#40a) are all invisible to CDN and WAF stacks operating on HTTP/S traffic only. Cloudflare Spectrum or Magic Transit is required to extend protection to arbitrary TCP/UDP ports. No tested vendor covers these at standard or free tiers.

LLM inference endpoints have no platform-level DDoS protection on any tested vendor

ThinkTrap (#148, arXiv 2025) and Semantic DoS (#149) target AI inference compute rather than network bandwidth. No CDN or WAF product tested has an inference-layer protection mechanism. On Cloudflare free tier, the absence of rate limiting means both attack classes reach origin unchecked. On AWS and Azure, LLM inference attacks are confirmed outside the DDoS protection scope.

IPv6 amplification protection significantly weaker than IPv4 (OVH, Hetzner, partial on AWS)

OVH VAC and Hetzner signature sets are IPv4-biased; IPv6 reflection and transparent forwarder amplification via IPv6 are significantly under-filtered. AWS Shield Advanced applies network-layer protections to IPv6 on supported endpoint types but with narrower coverage than IPv4. Cloudflare's anycast absorbs IPv6 volumetrically but faces the same IP-reputation limitation as IPv4 for legitimate-source floods.

Cloudflare edge-internal HTTP/3 amplification (WOOT 2025, #73a)

QUIC/HTTP/3 connections to Cloudflare's edge can fan out to more backend HTTP/1.1 connections than the inbound stream count implies. This is an architectural amplification path internal to the Cloudflare edge, not a customer-configuration issue. No customer-facing setting mitigates it; it requires Cloudflare server-side fixes. Relevant only when Cloudflare proxies an origin over HTTP/1.1.

Research basis: CCS 2025, SIGMETRICS 2025, WOOT 2025, NDSS 2026, ICC Workshops 2026, arXiv cs.CR 2025-2026. Internal taxonomy entries #40a, #40c, #73a, #126a, #136a, #148, #149 in ATTACK_TAXONOMY.md v0.8. Survey conducted 2026-08-30 via paperkit academic search engine against OpenAlex, DBLP, and arXiv.

Want this run against your edge?

Same harness, your domain. Free, gated by domain ownership verification. No card.

Start a scan →

Vendor, and think we got it wrong?

Send the trial access. We will re-run the harness against your product and update this page with the JSON receipt.

Write to research@ →

Edge Protection Scorecard

One-sentence summary