How to build a Scratch post that withstands a DDoS attack

A Scratch project hosted on Scratch lives within the platform’s infrastructure, but a personal blog can still control how its presentation page, media and community features are delivered. The useful definition of a Scratch post here is a static blog article or microsite that presents a Scratch build without requiring a database request every time somebody visits.

A dog chasing a rabbit provides both the visual theme and the technical distraction: the playful animation draws attention while cached assets, rate limits and a static fallback absorb the traffic. Building a Scratch post that withstands a DDoS attack therefore means making the page inexpensive to serve, difficult to amplify and safe to display when the busiest parts of the system become unavailable.

Separate the post from the platform

Begin by separating the public page from the systems used to create it. A publishing system with a WordPress database, plugin stack and admin interface offers useful editing tools, but every visitor request to that system can become an opportunity for expensive queries. Generate the finished article as static HTML whenever practical, then publish that file through a lightweight host or object-storage bucket.

Keep the Scratch embed, images, stylesheets and scripts as separate assets with stable URLs. A broken embed should leave the article readable rather than blanking the page. This separation also means database connection errors affect the editorial workflow, not every reader. The live post remains available while an administrator repairs the publishing database or deploys a corrected version.

Turn the dog into a lightweight distraction

Use an animal image or short animation to establish the mood without making it the heaviest object on the page. At Royal Park in Melbourne or Centennial Park in Sydney, a dog spotted near a rabbit recalls familiar park scenes, although Australian wildlife and leash rules still matter. The familiar story gives readers an immediate reason to stay without turning the scene into an invitation for uncontrolled animal chasing.

Prefer SVG, CSS animation or a compressed image for the dog-and-rabbit cover. Load a larger Scratch project only after interaction, and keep the initial view independent of any live API. This lazy-loading approach reduces ordinary bandwidth use while ensuring that a traffic flood cannot repeatedly trigger server-side game logic. The pet-focused experiments in studio pet portraits offer a useful example of creating a distinctive visual identity without requiring every effect to be fetched at once.

Cache the page before the rush

Place a content delivery network between visitors and the origin server. The CDN stores the static article, images and versioned assets at edge locations, serving cached copies while forwarding only cache misses to the host. This shortens the distance for readers on the NBN in Sydney, Melbourne or Perth and prevents thousands of simultaneous requests from arriving at one Australian web server.

Configure cache headers deliberately. Long-lived caching suits fingerprinted files such as app.abc123.css, while HTML should use a shorter lifetime with stale content available while it refreshes. Purge the page through the CDN when publishing an update instead of reaching into the origin manually. Australian cloud regions in Sydney and Melbourne can keep the origin close, but an edge cache remains valuable because consumer connections vary in speed and reliability.

Do not let query strings, login cookies or unusual request paths bypass the cache. Test the headers from several Australian networks before an attack, since a page that works in a browser can still be fetched directly at the origin. A stale cached article is a better outcome than an unavailable one, and it costs the site almost nothing to serve.

Put controls in front of the origin

Use a reputable CDN with web application firewall features as the first layer of protection. Apply rate limits to expensive routes, restrict accepted HTTP methods, cap upload sizes and challenge suspicious write requests. The origin should accept traffic only from the CDN’s published address ranges, preventing attackers from bypassing the edge layer and attacking the host directly.

Configure sensible timeouts and connection limits so abandoned requests cannot occupy workers indefinitely. Distributed attacks arrive from many addresses, making a simple per-IP ban insufficient, while a blanket block could affect legitimate users sharing a mobile connection. Start with conservative thresholds, watch actual traffic and adjust them gradually. For an Australian personal site, a free or pay-as-you-go plan with GST-inclusive AUD billing keeps this protection economically realistic without committing to a large enterprise contract.

Keep expensive work off the request path

A visitor opening an article should not need to open a database connection, process a template, query a plugin API and load five tracking scripts. Cache rendered pages, remove unused plugins and move functions such as comments, search and personalisation behind separate services. If those services fail, the main article should continue without them.

This matters because a distributed denial-of-service attack often targets the most expensive path. Repeated requests to a poorly indexed search function or an unthrottled contact form can create more work than the original page. The pet and game elements should also avoid triggering repeated database writes. A Scratch score may be submitted asynchronously, accepted through a queue and ignored when the backing service is unavailable.

For forms, collect only necessary information, validate it before processing and apply quotas at both the edge and application layers. A cached failure message is preferable to a form that holds every server worker open. The same principle applies to the database: when connection errors begin, stop opening new connections and serve the last known good content rather than allowing a connection pile-up to become the main outage.

Measure attacks without becoming the target

Establish a baseline for normal traffic before changing the infrastructure. Record requests, bandwidth, error rates, origin CPU and database connections during ordinary Australian browsing peaks. Alerts should distinguish a rise in cached traffic from one that reaches the origin, because the CDN may be handling the load successfully even while origin traffic remains flat.

Monitor from more than one location, including a check that runs from Perth, which is two hours behind the eastern states. Review the CDN logs for patterns rather than staring at every request, and apply temporary limits when a clear surge begins. By arvo, a concise summary of blocked traffic and remaining origin capacity gives the blog owner time to make a measured decision instead of reacting to every unfamiliar bot.

Keep the monitoring stack outside the attacked path and set spending alerts on CDN and hosting accounts. A defensive service can itself become costly under sustained load. Rate limits, sampling and automatic log rotation help preserve evidence without generating a second wave of expensive traffic.

Give the content a durable reason to return

Resilience works best when the page remains worth revisiting after the immediate excitement of a game or animal chase fades. Add a clear explanation, keyboard-accessible controls, alt text and lightweight references that make the Scratch project understandable even when it cannot load. A static fallback should still communicate the idea rather than displaying a generic outage notice.

Specific reporting gives a post lasting value. An article examining prairie birds and climate, for example, connects an animal subject to a broader environmental question instead of relying on novelty alone. The same editorial discipline helps the Scratch post remain credible: explain what the project demonstrates, record the build process and preserve the finished experience independently of a live database.

Test the fallback under realistic conditions, rehearse switching to cached content and document who can change DNS, purge caches or disable a troublesome plugin. When the alerts quiet and the old cache still serves the chase, the dog has done its job: the site remains playful while the machinery underneath stays calm.