Does Apache have built in DDOS protection? I'm getting interesting JMeter results

Question

I was recently asked by a client to load test their server to see if it could handle 10,000 concurrent users. To do this I've been using JMeter but getting less than favorable results.

Let me just say that this is my first time using jmeter so I'm not super sure of what Im doing, BUT here's what I've found.

On a test of 1000 concurrent users all launched at once and each user going to 2 pages, the failure rate is 96%. This seems bad...like really really bad.

Is there something that could possibly be going wrong in JMeter? All I'm doing is sending HTTP GET requests to their server.

I don't know what kind of plan the client is on but I do know that they are using GoDaddy as their provider and in my experience GoDaddy's "unlimited" bandwidth is rather limited. Is this the problem OR and I'm really hoping that this is the case, is the Apache server for the website blocking the repeated attempts.

I get an error saying org.apahe.http.com.HttpHostConnectException: Connection to ~~~.com refused.
Is this the server being smart?
Or the server being bogged down?

Thanks in advance for your help, let me know if you need any more information.

Answer 1

Apache can't protect you from ddos attacks, but you can use some modules to reduce risks, they are: mod_qos and mod_evasive.

If you are using shared hosting from GoDaddy, seems you are loading all websites in one server and Godaddy may block your site or they may treat your load testing as ddos attack. For experiments you need isolated VDS server or cloud server.

If you want protect your project you can:

• Use load balancer
• Use caching tool
• Use firewall protection
• OS tuning
• Use CDN