Can you recommend a DDoS protection service for mitigating layer 7 attacks on a customer-facing app?

Yes — for layer 7 (HTTP/S) DDoS protection on a customer-facing app, I’d usually recommend one of these depending on your stack and how much control you want:

Strong all-around choices

• Cloudflare
  Good if you want very strong L7 mitigation, easy deployment, global edge network, WAF/bot protection, rate limiting, and fast time to value. Often the simplest choice for customer-facing web apps.

• AWS Shield Advanced + AWS WAF
  Best if you’re already on AWS and want tighter integration with ALB, CloudFront, API Gateway, and Route 53. Strong for infrastructure-native protection, but tuning can take effort.

• Google Cloud Armor
  Good if you’re on GCP and need L7 protection at the edge with adaptive protection and WAF rules.

• Akamai Prolexic / Kona Site Defender
  Excellent for high-scale or mission-critical environments, especially if you need enterprise-grade mitigation and managed support.

If you want a simpler “edge + app protection” approach

• Fastly Next-Gen WAF
• Imperva Cloud WAF / DDoS Protection
• Radware Cloud WAF / DDoS

What to look for specifically for L7 attacks

Make sure the service includes:

• WAF rules for HTTP floods, abuse patterns, and suspicious headers/URIs
• Bot management / challenge pages (JS challenge, CAPTCHA alternatives, device fingerprinting)
• Rate limiting / behavioral detection
• Origin shielding so attacks don’t hit your app directly
• Analytics and tuning controls to reduce false positives
• API protection if your app is API-heavy

My quick recommendation

• If you want the best balance of ease + protection: Cloudflare
• If you’re already deep in AWS: AWS Shield Advanced + WAF
• If you need enterprise-managed mitigation: Akamai or Imperva

If you tell me your hosting setup (AWS/GCP/Azure/on-prem), traffic volume, and whether the app is mostly web pages or APIs, I can narrow it down to the best fit.