You can combat this a little with good architecture, by making sure the attacks won't stack. One part of the attack is finding a difficult-to-serve request. Th

You can combat this a little with good architecture, by making sure the attacks won't stack. One part of the attack is finding a difficult-to-serve request. The other part is being very slow at receiving the response, keeping the request alive. The impact is multiplied if you keep dozens exceptionally high-memory processess alive while the clients slowly the response that those processors generated. If you have the right architecture, it won't matter if the difficult-to-serve request takes a long time to send - you backend processes it, sends the response to your web server, and frees the resources (not holding resources until the client is happy).