Every refusal happens
at the cheapest point that can make it.

A request lands on the closest DEFLECTO location instead of travelling to your origin. Nothing has been decided yet. The only thing that has happened is that a flood is now spread across the network rather than converging on one address, which is what makes every decision below affordable.

Filtering runs inside the network driver, before the kernel allocates a socket for the connection. Malformed packets, unroutable ports and unauthorised sources are discarded at the earliest point the hardware allows. They are not accepted and then rejected, they are never accepted. Most of a volumetric flood ends here, in the part of the machine that has no idea what a request is.

Almost everything sold as DDoS protection filters above the socket, where the kernel has already done the accounting. Moving that decision into the driver is the single largest structural difference in this product.

Whatever survives the filter asks for a connection, and that request is judged on its own: concurrency per source, new connections per second, and a handshake budget. All of it is applied before any key exchange begins, because a handshake is the most expensive thing you can be talked into doing for a stranger.

The session is terminated at the edge, with certificates issued and renewed for you. This stage refuses nothing on its own. It is worth naming because it is the point where a stranger stops being cheap: asymmetric crypto is real CPU, spent before a single byte of the request has been read.

Now the request can be read. Heuristics, signatures and behavioural analysis combine into an anomaly score rather than a single verdict, so an unusual request and an obviously hostile one are not treated as the same event. Body size, header count, request shape and rate per route are all enforced here.

A score in the middle is not a reason to block someone, it is a reason to make them pay. Suspicious clients are handed a proof-of-work puzzle. A real visitor solves it invisibly, inside a page that is already loading. An attacker pays CPU on every single request, which is precisely the part of a flood that used to be free. Solve it once and a clearance carries the rest of the session, so nobody is asked twice.

A challenged request is never metered. Quota counts legitimate requests forwarded to your origin, so traffic that is challenged, refused or dropped costs you nothing at all.

What is left is forwarded over the protected path. Your origin address is never published and never appears in a response, so the only route to your infrastructure runs through gates that have already made six decisions about this request.