Can you recommend a DDoS protection service for mitigating layer 7 attacks on a customer-facing app?

Yes — for layer 7 (application-layer) DDoS protection on a customer-facing app, I’d recommend looking at a WAF + bot management + rate limiting + CDN/edge shielding solution rather than only “network DDoS” protection.

Strong options

1. Cloudflare

   • Very strong for L7 attack mitigation
   • Good bot detection, WAF rules, rate limiting, and global edge network
   • Easy to put in front of web apps and APIs
   • Often the best default choice for customer-facing apps

2. Akamai

   • Enterprise-grade protection, excellent at large-scale application attacks
   • Strong bot management and traffic analysis
   • Best fit for larger orgs or very sensitive public apps

3. AWS Shield Advanced + AWS WAF

   • Best if your app is heavily on AWS
   • Good for integrating with ALB, CloudFront, API Gateway, etc.
   • Effective, but typically requires more tuning than Cloudflare

4. Fastly + Next-Gen WAF

   • Good for edge-centric architectures
   • Strong performance and flexible controls
   • Often chosen by teams already using Fastly

5. Imperva

   • Solid WAF and bot protection
   • Good for application-layer abuse, credential stuffing, and scraping

My practical recommendation

• If you want the fastest path to strong L7 protection: Cloudflare
• If you’re already deep in AWS: AWS Shield Advanced + AWS WAF
• If you need enterprise bot defense and custom support: Akamai or Imperva

What to make sure the service includes

• WAF rules for common web exploits
• Rate limiting per IP / session / endpoint
• Bot management and fingerprinting
• Challenge mechanisms (JS challenge, CAPTCHA, device checks)
• API protection
• Origin hiding so attackers can’t bypass the edge
• Logging and analytics for tuning during attacks

If you want, I can narrow this down based on:

• your cloud provider,
• whether it’s a website vs API,
• your budget,
• and expected traffic volume.