Overview
Google Cloud Armor is the primary security layer protecting ecommerce sites hosted on our platform. Built on Google’s global edge network, it helps stop DDoS attacks, malicious bots, and common web-based threats before they reach your servers. This reduces load, improves site reliability, and keeps legitimate traffic flowing even during attack conditions.
Global, Edge-Level Protection
Cloud Armor filters traffic at Google’s worldwide edge locations. This ensures:
-
Low latency for real customers
-
High-capacity absorption of malicious traffic
-
The same underlying DDoS defenses used by Google’s own services
Because this protection is applied before traffic even reaches your application, many abusive requests are blocked without consuming your site’s resources.
Always-On DDoS Mitigation
Your site automatically benefits from Google’s global DDoS protection, which is designed to block large-scale volumetric and protocol-level attacks.
We configure platform-wide policies so that:
-
Known bad traffic patterns are filtered at the edge
-
Suspicious spikes can be mitigated without manual intervention
-
Legitimate traffic is prioritized so your customers can continue to browse and check out
Cost-Effective, Fully Managed
Cloud Armor requires no hardware, updates, or maintenance from you. Threat intelligence and rule updates are handled by Google and integrated into our hosting stack.
On our side, we manage:
-
Initial configuration and ongoing tuning at the platform level
-
Integration with our load balancers and monitoring tools
-
Review of alerts and anomalies as part of our standard operations
You get enterprise-grade edge protection without having to operate or maintain a separate security appliance.
Advanced Bot & Fraud Protection
Bot Management
Cloud Armor’s behavioral signals help distinguish legitimate users, harmless bots (e.g., search engine crawlers), and malicious automation. This helps reduce the impact of:
-
Credential stuffing
-
Excessive scraping
-
Inventory hoarding and checkout bots
Where appropriate, we can pair Cloud Armor with reCAPTCHA Enterprise to introduce step-up challenges and stronger bot scoring at key workflows (e.g., login or checkout). These configurations are managed at the platform level to keep behavior consistent and maintainable.
Carding Attack Mitigation
For ecommerce stores, Cloud Armor can help reduce fraudulent payment attempts by supporting controls such as:
-
Rate limiting for checkout flows
-
Geo-based restrictions for regions you don’t serve
-
Adaptive protection that reacts to abnormal traffic spikes
We apply these controls carefully to minimize false positives while reducing unnecessary payment gateway traffic during attack conditions.
Web Application Firewall (WAF) Capabilities
Cloud Armor includes Web Application Firewall (WAF) features based on industry standards (including protection against OWASP Top 10-style threats).
Important note about our current deployment:
-
Today, our platform primarily leverages Cloud Armor for DDoS mitigation, edge filtering, and bot/fraud reduction.
-
Full WAF rule sets and more granular application-level policies are in the process of being evaluated and rolled out in a controlled manner.
At this time, we do not offer ad hoc, per-site custom WAF rule tuning as a standard service. If you have a specific application security requirement, please contact our team so we can assess whether it fits into our shared platform policies or future roadmap.
Threat Visibility & Monitoring
Our team monitors Cloud Armor dashboards and logs to track:
-
Blocked attack attempts
-
Traffic anomalies and spikes
-
Geographic patterns and unusual behaviors
-
Request profiles and policy hits
These insights are used for:
-
Ongoing tuning of platform-wide protections
-
Incident investigation and response
-
Supporting your compliance and security review discussions (upon request)
Cloud Armor vs. Cloudflare
Both Cloud Armor and Cloudflare offer DDoS protection, WAF capabilities, bot filtering, and access controls.
In our hosted environment:
-
Cloud Armor is tightly integrated into our Google Cloud hosting stack
-
No separate reverse proxy configuration is required
-
Performance is optimized because protection is applied directly at Google’s edge, in the same path as your infrastructure
For most hosted sites, Cloud Armor provides all the edge protection needed without requiring an additional Cloudflare proxy layer.
When Cloudflare May Still Be Needed
You may want to keep Cloudflare in front of your site if you actively rely on:
-
Cloudflare Workers or Pages
-
Cloudflare-specific integrations or third-party apps
-
Specialized Cloudflare features that Cloud Armor does not replicate
If you have Cloudflare-specific workflows today and are considering moving fully onto our Cloud Armor–based stack, please reach out to our team. We can help review your current usage and determine whether those needs are met by our platform or if Cloudflare should remain in place.
Getting Started
Cloud Armor protection is already active for every hosted ecommerce site on our platform. No additional setup is required beyond ensuring your domain’s DNS records are configured correctly to point to our infrastructure.
If you would like a security review of your current setup, or have questions about Cloud Armor, bot/fraud protections, or future WAF capabilities, please contact our support team or your account manager.