Radar has landed - discover the latest DDoS attack trends. Get ahead, stay protected.Get the report
Under attack?

Products

Solutions

Pricing

Resources

Partners

Why Gcore

Under attack?
Contact us
Contact us Sign up for free

Developers

Discover the latest industry trends, get ahead with cutting‑edge insights, and be in the know about the newest Gcore innovations.

BlogDevelopers
Fundamentals

3 ways to safeguard your website against DDoS attacks—and why it matters

DDoS (distributed denial-of-service) attacks are a type of cyberattack in which a hacker overwhelms a server with an excessive number of requests, causing the server to stop functioning correctly and denying access to legitimate users. The volume of these types of attacks is increasing, with a 56% year-on-year rise recorded in late 2024, driven by factors including the growing availability of AI-powered tools, poorly secured IoT devices, and geopolitical tensions worldwide.Fortunately, there are effective ways to defend against DDoS attacks. Because these threats can target different layers of your network, a single tool isn’t enough, and a multi-layered approach is necessary. Businesses need to protect both the website itself and the infrastructure behind it. This article explores the three key security solutions that work together to protect your website—and the costly consequences of failing to prepare.The consequences of not protecting your website against DDoS attacksIf your website isn’t sufficiently protected, DDoS attacks can have severe and far-reaching impacts on your website, business, and reputation. They not only disrupt the user experience but can spiral into complex, costly recovery efforts. Safeguarding your website against DDoS attacks is essential to preventing the following serious outcomes:Downtime: DDoS attacks can exhaust server resources (CPU, RAM, throughput), taking websites offline and making them unavailable to end users.Loss of business/customers: Frustrated users will leave, and many won’t return after failed checkouts or broken sessions.Financial losses: By obstructing online sales, DDoS attacks can cause businesses to suffer substantial loss of revenue.Reputational damage: Websites or businesses that suffer repeated unmitigated DDoS attacks may cause customers to lose trust in them.Loss of SEO rankings: A website could lose its hard-won SEO ranking if it experiences extended downtime due to DDoS attacks.Disaster recovery costs: DDoS disaster recovery costs can escalate quickly, encompassing hardware replacement, software upgrades, and the need to hire external specialists.Solution #1: Implement dedicated DDoS protection to safeguard your infrastructureAdvanced DDoS protection measures are customized solutions designed to protect your servers and infrastructure against DDoS attacks. DDoS protection helps defend against malicious traffic designed to crash servers and interrupt service.Solutions like Gcore DDoS Protection continuously monitor incoming traffic for suspicious patterns, allowing them to automatically detect and mitigate attacks in real time. If your resources are attacked, the system filters out harmful traffic before it reaches your servers. This means that real users can access your website without interruption, even during an attack.For example, a financial services provider could be targeted by cybercriminals attempting to disrupt services with a large-scale volumetric DDoS attack. With dedicated DDoS protection, the provider can automatically detect and filter out malicious traffic before it impacts users. Customers can continue to log in, check balances, and complete transactions, while the system adapts to the evolving nature of the attack in the background, maintaining uninterrupted service.The protection scales with your business needs, automatically adapting to higher traffic loads or more complex attacks. Up-to-date reports and round-the-clock technical support allow you to keep track of your website status at all times.Solution #2: Enable WAAP to protect your websiteGcore WAAP (web application and API protection) is a comprehensive solution that monitors, detects, and mitigates cyber threats, including DDoS layer 7 attacks. WAAP uses AI-driven algorithms to monitor, detect, and mitigate threats in real time, offering an additional layer of defense against sophisticated attackers. Once set up, the system provides powerful tools to create custom rules and set specific triggers. For example, you can specify the conditions under which certain requests should be blocked, such as sudden spikes in API calls or specific malicious patterns common in DDoS attacks.For instance, an e-commerce platform during a major sale like Black Friday could be targeted by bots attempting to flood the site with fake login or checkout requests. WAAP can differentiate between genuine users and malicious bots by analyzing traffic patterns, rate of requests, and attack behaviors. It blocks malicious requests so that real customers can continue to complete transactions without disruption.Solution #3: Connect to a CDN to strengthen defenses furtherA trustworthy content delivery network (CDN) is another valuable addition to your security stack. A CDN is a globally distributed server network that ensures efficient content delivery. CDNs spread traffic across multiple global edge servers, reducing the load on the origin server. During a DDoS attack, a CDN with DDoS protection can protect servers and end users. It filters traffic at the edge, blocking threats before they ever reach your infrastructure. Caching servers within the CDN network then deliver the requested content to legitimate users, preventing network congestion and denial of service to end users.For instance, a gaming company launching a highly anticipated multiplayer title could face a massive surge in traffic as players around the world attempt to download and access the game simultaneously. This critical moment also makes the platform a prime target for DDoS attacks aimed at disrupting the launch. A CDN with integrated DDoS protection can absorb and filter out malicious traffic at the edge before it reaches the core infrastructure. Legitimate players continue to enjoy fast downloads and seamless gameplay, while the origin servers remain stable and protected from overload or downtime.In addition, Super Transit intelligently routes your traffic via Gcore’s 180+ point-of-presence global network, proactively detecting, mitigating, and filtering DDoS attacks. Even mid-attack, users experience seamless access with no interruptions. They also benefit from an enhanced end-user experience, thanks to shorter routes between users and servers that reduce latency.Taking the next steps to protect your websiteDDoS attacks pose significant threats to websites, but a proactive approach is the best way to keep your site online, secure, and resilient. Regardless of your industry or location, it’s crucial to take action to safeguard your website and maintain its uninterrupted availability.Enabling Gcore DDoS protection is a simple and proven way to boost your digital infrastructure’s resiliency against different types of DDoS attacks. Gcore DDoS protection also integrates with other security solutions, including Gcore WAAP, which protects your website and CDNs. These tools work seamlessly together to provide advanced website protection, offering improved security and performance in one intuitive platform.If you’re ready to try Gcore Edge Security, fill in the form below and one of our security experts will be in touch for a personalized consultation.

July 8, 2025 4 min read
How-tos

Tuning Gcore CDN rules for dynamic application data caching

Caching services like content delivery networks (CDNs) can be a solid addition to your web stack. They lower response latency and improve user experience while also helping protect your origin servers through security features like access control lists (ACLs) and traffic filtering. However, if you’re running a highly dynamic web service, a misconfigured CDN might lead to the delivery of stale or, in the worst case, wrong data.If you’re hosting a dynamic web service and want to speed it up, this guide is for you. It explains the common issues dynamic services have with CDNs and how to solve them with Gcore CDN.How does dynamic data differ from static data?There are two main differences between static and dynamic data:Change frequency: Dynamic data changes more often than static data. Some websites stay the same for weeks or months; others change multiple times daily.Personalized responses: Static systems deliver the same response for a given URL path. Dynamic systems, by contrast, can generate different responses for each user, based on parameters like authentication, location, session data, or user preferences.Now, you might ask: Aren’t static websites simply HTML pages while dynamic ones are generated on-the-fly by application servers?It depends.A website consisting only of HTML pages might still be dynamic if the pages are changed frequently, and an application server that generates HTML responses can serve the same HTML forever and always provide everyone with the same content for a URL. The CDN network doesn’t know how you create the HTML. It only sees the finished product and decides how long it should cache it. You need to decide on a case-by-case basis.How do cache rules affect dynamic data?When using a CDN, you have to define rules that govern the caching of your data. If you consider this data dynamic, either because it changes frequently or because you deliver user-specific responses, those rules can drastically impact the user experience, ranging from the delivery of stale data to completely wrong data.Cache expirationFirst, consider cache expiration time. With Gcore CDN, you have two options:Let your origin server control it. This is ideal for dynamic systems using application servers because it gives you precise control without needing to adjust Gcore settings.Let Gcore CDN control it. This works well for static HTTP servers delivering HTML pages that change often. If you can’t modify the server’s cache configuration, using Gcore’s settings is easier.No matter which method you choose, understand what your users consider “stale” and set the expiration time accordingly.Query string handlingNext, decide how Gcore CDN should handle URL query parameters. Ignoring them can improve performance—but for dynamic systems that use query strings for server-side sorting, filtering, or pagination, this can break functionality.For example, a headless CMS might use: https://example.com/api/posts?sort=asc&start=99If the CDN ignores the query string, it will always deliver the cached response, even if new parameters are requested. So, make sure to disable the Ignore query string parameters setting when necessary.Cookie bypassingCookies are often used for session handling. While ignoring cookies can boost performance, doing so risks breaking applications that rely on them.For example: https://example.com/api/users/profileIf this endpoint relies on a session cookie, caching without considering the cookie will serve the same user profile to everyone. Be sure to disable “Ignore cookies” if your server uses them for authentication or personalization.Cache key customizationIf you need more detailed control over the caching, you can modify the cache key generation. This key defines the mapping of a request to a cache entry and allows you to manage the granularity of your caching.The Gcore Customer Portal offers basic customization functionality, and the support team can help with advanced rules. For example, adding the request method (e.g., GET, HEAD, POST, etc.) to your cache key ensures a single URL has a dedicated cache entry for each method instead of using one for all.GraphQL considerationsMost GraphQL implementations only use POST requests and include the GraphQL query in the request body. This means every GraphQL request will use the same URL and the same method, regardless of the query. Gcore CDN doesn’t check the request body when caching, so every query will result in the same cache key and override each other.To make sure the CDN doesn’t break your API, turn off caching for all your GraphQL endpoints.Path-based CDN rules for hybrid contentIf your application serves both static and dynamic content across different paths, Gcore CDN rules offer a powerful way to manage caching more granularly.Using the CDN rules engine, you can create specific rules for individual file paths or extensions. This allows you to apply dynamic-appropriate settings—like disabling caching or respecting cookies—only to dynamic endpoints (e.g., /api/**), while using more aggressive caching for static assets (e.g., /assets/**, /images/**, or /js/**).This path-level control delivers performance gains from CDN caching without compromising the correctness of dynamic content delivery.SummaryUsing a CDN is an easy way to improve your site’s performance, and even dynamic applications can benefit from CDN caching when configured correctly. Check that:Expiration times reflect real-world freshness needsQuery strings and cookies aren’t ignored if they affect the responseCache keys are customized where neededGraphQL endpoints are excluded from cachingCDN rules are used to apply different settings for dynamic and static pathsWith the right setup, you can safely speed up even the most complex applications.Explore our step-by-step guide to setting rules for particular files in Gcore CDN.Discover Gcore CDN

July 3, 2025 3 min read
Fundamentals

How AI is reshaping the future of interactive streaming

Interactive streaming is entering a new era. Artificial intelligence is changing how live content is created, delivered, and experienced. Advances in real-time avatars, voice synthesis, deepfake rendering, and ultra-low-latency delivery are giving rise to new formats and expectations.Viewers don’t want to be passive audiences anymore. They want to interact, influence, and participate. For platforms that want to lead, the stakes are growing: innovate now, or fall behind.At Gcore, we support this shift with global streaming infrastructure built to handle responsive, AI-driven content at scale. This article explores how real-time interactivity is evolving and how you can prepare for what’s next.A new era for live contentStreaming used to mean watching someone else perform. Today, it’s becoming a conversation between the creator and the viewer. AI tools are making live content more reactive and personalized. A cooking show host can take ingredient requests from the audience and generate live recipes. A language tutor can assess student pronunciation and adjust the lesson plan on the spot. These aren’t speculative use cases—they’re already being piloted.Traditional cameras and presenters are no longer required. Some creators now use entirely digital hosts, powered by motion capture and generative AI. They can stream with multiple personas, switch backgrounds on command, or pause for mid-session translations. This evolution is not about replacing humans but creating new ways to engage that scale across time zones, languages, and platforms.Creating virtual influencersVirtual influencers are digital characters designed to build audiences, promote products, and hold conversations with followers. Unlike human influencers, they don’t get tired, change jobs, or need extensive re-shoots when messaging changes. They’re fully programmable, and the most successful ones are backed by teams of writers, animators, and brand strategists.For example, a skincare company might launch a virtual influencer with a consistent tone, recognizable look, and 24/7 availability. This persona could host product tutorials in the morning, respond to DMs during the day, and livestream reactions to customer feedback at night—all in the local language of the audience.These characters are not limited to influencer marketing. A virtual celebrity might appear as a guest at a live product launch or provide commentary during a sports event. The point is consistency, scalability, and control. Gcore’s global delivery network ensures these digital personas perform without delay, wherever the audience is located.Real-time avatars and AI-generated personasReal-time avatars use motion capture and emotion detection to mimic human behavior with digital models. A fitness instructor can appear as a stylized avatar while tracking their own real movements. A virtual talk show host can gesture, smile, or pause in response to viewer comments. These avatars do more than just look the part—they respond dynamically.AI-generated personas build on this foundation with language generation and decision-making. For instance, an edtech company could deploy a digital tutor that asks learners comprehension questions and adapts its tone based on their engagement level. In entertainment, a music artist might perform live as a virtual character that reflects audience mood through color shifts, dance patterns, or facial expression.These experiences require ultra-low latency. If the avatar lags, the illusion collapses. Gcore’s infrastructure supports the real-time input-output loop needed to make digital characters feel present and responsive.Deepfake technology for creative storytellingDeepfakes are often associated with misinformation, but the same tools can be used to build engaging, high-integrity content. The technology enables face-swapping, voice cloning, and character animation, all of which are powerful in live formats.A museum might use deepfake avatars of historical figures for interactive educational sessions. Visitors could ask questions, and Abraham Lincoln or Golda Meir might respond with historically grounded answers in real time. A brand could create a fictional spokesperson who evolves over time, appearing in product demos, ads, and livestreams. Deepfake technology also allows multilingual content without re-recording—the speaker’s lip movements and tone are modified to match each language.These applications raise legitimate ethical questions. Gcore’s streaming infrastructure includes controls to ensure the source and integrity of AI-generated content are traceable and secure. We provide the technical foundation that enables deepfake use cases without compromising trust.Synthetic voices and personalized audioAudio is often overlooked in discussions about AI streaming, but it’s just as important as video. Synthetic voices today can express subtle emotions and match speaking styles. They can whisper, shout, pause for dramatic effect, and even mimic regional accents.Let’s consider a news platform that offers interactive daily briefings. Viewers choose their preferred language, delivery style (casual, serious, humorous), and even the voice profile. The AI generates a personalized broadcast on the fly. In gaming, synthetic characters can offer encouragement, warn about strategy mistakes, or narrate progress—all without human voice actors.Gcore’s streaming infrastructure ensures that synthetic voice outputs are tightly synchronized with video, so users don’t experience out-of-sync dialogue or lag during back-and-forth exchanges.Increasing interactivity through feedback and participationInteractivity in streaming now goes far beyond comments or emoji reactions. It includes live polls that influence story outcomes, branching narratives based on audience behavior, and user-generated content layered into the broadcast.For example, a live talent show might allow viewers to suggest challenges mid-broadcast. An online classroom could let students vote on the next topic. A product launch might include a real-time Q&A where the host pulls questions from chat and answers them in the moment.All of these use cases rely on real-time data processing, behavior tracking, and adaptive rendering. Gcore’s platform handles the underlying complexity so that creators can focus on building experiences, not infrastructure.Why low latency is criticalInteractive content only works if it feels immediate. A delay of even a second can break immersion, especially when users are trying to influence the outcome or receive a response. Low latency is essential for real-time gaming, sports, interviews, and educational formats.A live trivia game with hundreds of participants won’t retain users if there’s a lag between the question appearing and the timer starting. A remote surgery training session won’t work if the avatar’s responses trail behind the mentor’s instructions. In each of these cases, timing is everything.Gcore Video Streaming minimizes buffering, supports high-resolution streams, and synchronizes data flows to keep participants engaged. Our infrastructure is built to support high-throughput, globally distributed audiences with the responsiveness that interactive formats demand.Preparing for what’s nextAI-generated content is no longer a novelty. It’s becoming a standard feature of modern streaming strategies. Whether you’re building a platform that features virtual influencers, immersive avatars, or interactive educational streams, the foundation matters. That foundation is infrastructure.If you’re planning the next generation of live content, we’re ready to help you bring it to life. At Gcore, we provide the performance, scale, and security to launch these experiences with confidence. Our streaming solutions are designed to support real-time content generation, audience interaction, and global delivery without compromise.Want to see interactive streaming in action? Learn how fan.at used Gcore Video Streaming to deliver ultra-low-latency streams and boost fan engagement with real-time features.Read the case study

June 24, 2025 4 min read
Fundamentals

What are captions and subtitles, and how do they work?

Subtitles and captions are essential to consuming video content today. But how do they work behind the scenes?Creating subtitles and captions involves a five-step process to ensure that your video’s spoken and auditory content is accurately and effectively conveyed. The five steps are transcription, correction, synchronization/spotting, translation, and simulation/display on screen.The whole process is usually managed using specialized subtitle or caption creator software.In this blog, we explain the five steps in more detail, what the end user sees, and how to choose the right caption/subtitle service for your needs.Step 1: TranscriptionSpoken content is transformed into a text-based format. Formats are different ways to implement the textual elements, depending on technical needs.Transcription creates the raw materials that will be refined in stages 2–4.Step 2: CorrectionCorrection enhances readability by improving the textual flow. Punctuation, grammar, and sentence structure are adjusted so that the user’s reading experience is seamless and doesn’t detract from the content.Step 3: Synchronization/spottingNext, the text and audio are aligned precisely. Each caption or subtitle’s timing is adjusted so it appears and disappears at the correct moment.Step 4: TranslationTranslation is required for content intended for consumption in multiple languages. During this stage, it’s important to consider format requirements and character limitations. For example, a caption that fits on two lines in English might require three in Spanish, and so in Spanish, one caption becomes two. As a result, additional synchronization might be necessary.Step 5: Simulation/display on screenFinally, the captions or subtitles need to be integrated onto the end user’s screen. Formatting issues might arise at this stage, requiring tweaks for an optimal user experience.How does the end user see subtitles and captions?After the technical process of creating captions and subtitles, the next step is understanding how these elements appear to the end user. The type of captions you choose can greatly impact the user experience, especially when considering accessibility, engagement, and clarity. Below, we break down the different options available and how they serve different viewing scenarios.Open captions: These are always visible to viewers and are a fixed part of the video. They’re popular, for example, for video installations in museums and employee training videos—cases where maximum accessibility is the key consideration when it comes to captions and/or subtitles.Closed captions: Viewers can turn these on or off based on preference. For instance, an online course might offer this feature, allowing learners to choose how to consume the content. Students could opt temporarily to turn on closed captions to note the spelling of a new term introduced during the course.Real-time captions: These are great for live events like webinars, where the text appears almost simultaneously as the words are spoken. They keep the audience engaged in real time without missing out on crucial points. For example, ambient noise like chatter in a sports bar might obscure commentary on a live TV basketball game. Real-time captions allow viewers to benefit from near-live commentary regardless of the bar’s noise levels or if the TV’s sound is muted.Burned-in subtitles: These are etched onto the video and cannot be turned off. A promotional video targeting a multilingual audience might use this feature so that everyone understands the message, regardless of their language preference.What to look for in captioning and subtitling servicesTo deliver high-quality captions and subtitles, it's important to choose a provider that offers key features for accuracy, efficiency, and audience engagement.Original language transcription: Accurate documentation of every spoken word in your video for unrivaled accuracy.Tailored translation: Localized content that integrates translations with cultural relevance, increasing resonance with diverse audiences.Alignment synchronization: Time-annotated subtitles, matching words perfectly to the on-screen action.Automatic SRT file generation: A simplified subtitling and captioning process through effortless file creation for a better user experience.Transform your videos with cutting-edge captions and subtitles from GcoreNo matter your video content needs, it’s essential to be aware of the best type of captions and subtitles for your audience’s needs. Choosing the right format ensures a smoother viewing experience, better accessibility, and stronger engagement across every platform.Gcore Video Streaming offers subtitles and closed captions to enhance users’ experience. Each feature within the subtitling and captioning toolkit is crafted to expand your video content’s reach and impact, catering to a multitude of use cases. Embedding captions is quick and easy, and AI-automated speech recognition also saves you time and money.Try Gcore's automated subtitle and caption solution for free

June 16, 2025 3 min read
Fundamentals

Why captions and subtitles are essential for video engagement

From TikToks on silent commutes to training videos in noisy offices, silent viewing is now standard. Captions and subtitles aren’t just accessibility features anymore. They’re essential for user engagement, global reach, and video performance.This article explores why captions and subtitles matter and how they boost engagement with your videos, providing a better user experience for your audience. If you want to know how captions and subtitles work, we’ve got an article for that too.How subtitles and captions improve your video performanceSubtitles are now widely used across platforms and age groups. For many younger viewers, reading along while watching is second nature, especially on social media. For others, subtitles are a practical solution: watching videos in public spaces, scrolling during breaks, or learning on the go—all without needing sound.Captions offer tangible benefits across four key areas:Engagement and comprehension: Improve clarity in movies, boost understanding in online courses, and increase focus in business content.Accessibility and inclusion: Make content available to hard-of-hearing users and break language barriers for global audiences.SEO and discoverability: Search engines can crawl subtitle text, making your video content more findable, even when autoplayed without sound.Silent usability: Your content works in all environments, from crowded trains to quiet offices.Captions have shifted from niche to norm, helping creators reach more people, boost retention, and deliver clearer messages.Common challenges and their solutionsImplementing captions at scale poses three major challenges: cost, delay, and accuracy. Here's why these challenges exist and how Gcore Video Streaming can help you overcome them at the click of a button.CostInvesting in high-quality transcriptions can be a financial burden, especially for smaller players in online education. Specialized expertise is required for accurate educational content, and human oversight adds ongoing labor costs. Transcription is a recurring expense that grows with multiple languages or regulatory compliance.Gcore scalable AI-powered transcription services reduce reliance on costly manual processes, offering affordable, multi-language support with built-in compliance features, making transcription cost-effective for all budgets.Delay/latencyIn live events, even slight delays in captioning can disengage audiences. For example, in a Formula One race, missing real-time commentary on pit stops or track conditions can leave viewers confused or frustrated. Lagging captions fail to keep pace with the action, breaking immersion.Real-time AI ASR (automatic speech recognition) from Gcore minimizes captioning delay, so that live captions sync perfectly with events, keeping viewers fully engaged without lag.AccuracyA small text error in captions can distort the message and harm reputation. Errors in MOOCs or corporate webinars risk undermining credibility and discouraging future participation. Precision is critical to maintain trust and clarity.Gcore leverages advanced AI models fine-tuned for domain-specific vocabulary and includes automated quality checks, drastically reducing errors and preserving message integrity across all video content.Enhance your video content with Gcore AI-powered caption and subtitles toolsCaptions are now a strategic content layer, not just an accessibility checkbox. With video now the dominant format across marketing, education, and entertainment, it's critical to implement captions efficiently, affordably, and at scale.Gcore’s AI-powered Video Streaming lets you generate accurate, real-time captions across multiple languages with minimal developer effort. Built-in AI ASR (automatic speech recognition) means your captions stay synchronized even during fast-paced live events. Whether you’re running an LMS, hosting global events, or publishing OTT content, Gcore Video Streaming helps you scale captions with speed and precision.Request a demo of Gcore AI ASR

June 12, 2025 2 min read
How-tos

Pre-configure your dev environment with Gcore VM init scripts

Provisioning new cloud instances can be repetitive and time-consuming if you’re doing everything manually: installing packages, configuring environments, copying SSH keys, and more. With cloud-init, you can automate these tasks and launch development-ready instances from the start.Gcore Edge Cloud VMs support cloud-init out of the box. With a simple YAML script, you can automatically set up a development-ready instance at boot, whether you’re launching a single machine or spinning up a fleet.In this guide, we’ll walk through how to use cloud-init on Gcore Edge Cloud to:Set a passwordInstall packages and system updatesAdd users and SSH keysMount disks and write filesRegister services or install tooling like Docker or Node.jsLet’s get started.What is cloud-init?cloud-init is a widely used tool for customizing cloud instances during the first boot. It reads user-provided configuration data—usually YAML—and uses it to run commands, install packages, and configure the system. In this article, we will focus on Linux-based virtual machines.How to use cloud-init on GcoreFor Gcore Cloud VMs, cloud-init scripts are added during instance creation using the User data field in the UI or API.Step 1: Create a basic scriptStart with a simple YAML script. Here’s one that updates packages and installs htop:#cloud-config package_update: true packages: - htop Step 2: Launch a new VM with your scriptGo to the Gcore Customer Portal, navigate to VMs, and start creating a new instance (or just click here). When you reach the Additional options section, enable the User data option. Then, paste in your YAML cloud-init script.Once the VM boots, it will automatically run the script. This works the same way for all supported Linux distributions available through Gcore.3 real-world examplesLet’s look at three examples of how you can use this.Example 1: Add a password for a specific userThe below script sets the for the default user of the selected operating system:#cloud-config password: <password> chpasswd: {expire: False} ssh_pwauth: True Example 2: Dev environment with Docker and GitThe following script does the following:Installs Docker and GitAdds a new user devuser with sudo privilegesAuthorizes an SSH keyStarts Docker at boot#cloud-config package_update: true packages: - docker.io - git users: - default - name: devuser sudo: ALL=(ALL) NOPASSWD:ALL groups: docker shell: /bin/bash ssh-authorized-keys: - ssh-rsa AAAAB3Nza...your-key-here runcmd: - systemctl enable docker - systemctl start docker Example 3: Install Node.js and clone a repoThis script installs Node.js and clones a GitHub repo to your Gcore VM at launch:#cloud-config packages: - curl runcmd: - curl -fsSL https://deb.nodesource.com/setup_18.x | bash - - apt-get install -y nodejs - git clone https://github.com/example-user/dev-project.git /home/devuser/project Reusing and versioning your scriptsTo avoid reinventing the wheel, keep your cloud-init scripts:In version control (e.g., Git)Templated for different environments (e.g., dev vs staging)Modular so you can reuse base blocks across projectsYou can also use tools like Ansible or Terraform with cloud-init blocks to standardize provisioning across your team or multiple Gcore VM environments.Debugging cloud-initIf your script doesn’t behave as expected, SSH into the instance and check the cloud-init logs:sudo cat /var/log/cloud-init-output.log This file shows each command as it ran and any errors that occurred.Other helpful logs:/var/log/cloud-init.log /var/lib/cloud/instance/user-data.txt Pro tip: Echo commands or write log files in your script to help debug tricky setups—especially useful if you’re automating multi-node workflows across Gcore Cloud.Tips and best practicesIndentation matters! YAML is picky. Use spaces, not tabs.Always start the file with #cloud-config.runcmd is for commands that run at the end of boot.Use write_files to write configs, env variables, or secrets.Cloud-init scripts only run on the first boot. To re-run, you’ll need to manually trigger cloud-init or re-create the VM.Automate it all with GcoreIf you're provisioning manually, you're doing it wrong. Cloud-init lets you treat your VM setup as code: portable, repeatable, and testable. Whether you’re spinning up ephemeral dev boxes or preparing staging environments, Gcore’s support for cloud-init means you can automate it all.For more on managing virtual machines with Gcore, check out our product documentation.Explore Gcore VM product docs

May 26, 2025 3 min read
How-tos

How to cut egress costs and speed up delivery using Gcore CDN and Object Storage

If you’re serving static assets (images, videos, scripts, downloads) from object storage, you’re probably paying more than you need to, and your users may be waiting longer than they should.In this guide, we explain how to front your bucket with Gcore CDN to cache static assets, cut egress bandwidth costs, and get faster TTFB globally. We’ll walk through setup (public or private buckets), signed URL support, cache control best practices, debugging tips, and automation with the Gcore API or Terraform.Why bother?Serving directly from object storage hits your origin for every request and racks up egress charges. With a CDN in front, cached files are served from edge—faster for users, and cheaper for you.Lower TTFB, better UXWhen content is cached at the edge, it doesn’t have to travel across the planet to get to your user. Gcore CDN caches your assets at PoPs close to end users, so requests don’t hit origin unless necessary. Once cached, assets are delivered in a few milliseconds.Lower billsMost object storage providers charge $80–$120 per TB in egress fees. By fronting your storage with a CDN, you only pay egress once per edge location—then it’s all cache hits after that. If you’re using Gcore Storage and Gcore CDN, there’s zero egress fee between the two.Caching isn’t the only way you save. Gcore CDN can also compress eligible file types (like HTML, CSS, JavaScript, and JSON) on the fly, further shrinking bandwidth usage and speeding up file delivery—all without any changes to your storage setup.Less origin traffic and less data to transfer means smaller bills. And your storage bucket doesn’t get slammed under load during traffic spikes.Simple scaling, globallyThe CDN takes the hit, not your bucket. That means fewer rate-limit issues, smoother traffic spikes, and more reliable performance globally. Gcore CDN spans the globe, so you’re good whether your users are in Tokyo, Toronto, or Tel Aviv.Setup guide: Gcore CDN + Gcore Object StorageLet’s walk through configuring Gcore CDN to cache content from a storage bucket. This works with Gcore Object Storage and other S3-compatible services.Step 1: Prep your bucketPublic? Check files are publicly readable (via ACL or bucket policy).Private? Use Gcore’s AWS Signature V4 support—have your access key, secret, region, and bucket name ready.Gcore Object Storage URL format: https://<bucket-name>.<region>.cloud.gcore.lu/<object> Step 2: Create CDN resource (UI or API)In the Gcore Customer Portal:Go to CDN > Create CDN ResourceChoose "Accelerate and protect static assets"Set a CNAME (e.g. cdn.yoursite.com) if you want to use your domainConfigure origin:Public bucket: Choose None for authPrivate bucket: Choose AWS Signature V4, and enter credentialsChoose HTTPS as the origin protocolGcore will assign a *.gcdn.co domain. If you’re using a custom domain, add a CNAME: cdn.yoursite.com CNAME .gcdn.co Here’s how it works via Terraform: resource "gcore_cdn_resource" "cdn" { cname = "cdn.yoursite.com" origin_group_id = gcore_cdn_origingroup.origin.id origin_protocol = "HTTPS" } resource "gcore_cdn_origingroup" "origin" { name = "my-origin-group" origin { source = "mybucket.eu-west.cloud.gcore.lu" enabled = true } } Step 3: Set caching behaviorSet Cache-Control headers in your object metadata: Cache-Control: public, max-age=2592000 Too messy to handle in storage? Override cache logic in Gcore:Force TTLs by path or extensionIgnore or forward query strings in cache keyStrip cookies (if unnecessary for cache decisions)Pro tip: Use versioned file paths (/img/logo.v3.png) to bust cache safely.Secure access with signed URLsWant your assets to be private, but still edge-cacheable? Use Gcore’s Secure Token feature:Enable Secure Token in CDN settingsSet a secret keyGenerate time-limited tokens in your appPython example: import base64, hashlib, time secret = 'your_secret' path = '/videos/demo.mp4' expires = int(time.time()) + 3600 string = f"{expires}{path} {secret}" token = base64.urlsafe_b64encode(hashlib.md5(string.encode()).digest()).decode().strip('=') url = f"https://cdn.yoursite.com{path}?md5={token}&expires={expires}" Signed URLs are verified at the CDN edge. Invalid or expired? Blocked before origin is touched.Optional: Bind the token to an IP to prevent link sharing.Debug and cache tuneUse curl or browser devtools: curl -I https://cdn.yoursite.com/img/logo.png Look for:Cache: HIT or MISSCache-ControlX-Cached-SinceCache not working? Check for the following errors:Origin doesn’t return Cache-ControlCDN override TTL not appliedCache key includes query strings unintentionallyYou can trigger purges from the Gcore Customer Portal or automate them via the API using POST /cdn/purge. Choose one of three ways:Purge all: Clear the entire domain’s cache at once.Purge by URL: Target a specific full path (e.g., /images/logo.png).Purge by pattern: Target a set of files using a wildcard at the end of the pattern (e.g., /videos/*).Monitor and optimize at scaleAfter rollout:Watch origin bandwidth dropCheck hit ratio (aim for >90%)Audit latency (TTFB on HIT vs MISS)Consider logging using Gcore’s CDN logs uploader to analyze cache behavior, top requested paths, or cache churn rates.For maximum savings, combine Gcore Object Storage with Gcore CDN: egress traffic between them is 100% free. That means you can serve cached assets globally without paying a cent in bandwidth fees.Using external storage? You’ll still slash egress costs by caching at the edge and cutting direct origin traffic—but you’ll unlock the biggest savings when you stay inside the Gcore ecosystem.Save money and boost performance with GcoreStill serving assets direct from storage? You’re probably wasting money and compromising performance on the table. Front your bucket with Gcore CDN. Set smart cache headers or use overrides. Enable signed URLs if you need control. Monitor cache HITs and purge when needed. Automate the setup with Terraform. Done.Next steps:Create your CDN resourceUse private object storage with Signature V4Secure your CDN with signed URLsCreate a free CDN resource now

May 19, 2025 3 min read
Fundamentals

From reactive to proactive: how AI is transforming WAF cybersecurity solutions

While digital transformation in recent years has driven great innovation, cyber threats have changed in parallel, evolving to target the very applications businesses rely on to thrive. Traditional web application security measures, foundational as they may be, are no longer effective in combating sophisticated attacks in time. Enter the next generation of WAFs (web application firewalls) powered by artificial intelligence.Next-generation WAFs, often incorporated into WAAP solutions, do much more than respond to threats; instead, they will use AI and ML-powered techniques to predict and neutralize threats in real time. This helps businesses to stay ahead of bad actors by securing applications, keeping valuable data safe, and protecting hard-earned brand reputations against ever-present dangers in an expanding digital world.From static to AI-powered web application firewallsTraditional WAFs were relied on to protect web applications against known threats, such as SQL injection and cross-site scripting. They’ve done a great job as the first line of defense, but their reliance on static rules and signature-based detection means they struggle to keep up with today’s fast-evolving cyber threats. To understand in depth why traditional WAFs are no longer sufficient in today’s threat landscape, read our ebook.AI and ML have already revolutionized what a WAF can do. AI/ML-driven WAFs can examine vast streams of traffic data and detect patterns, including new threats, right at the emergence stage. The real-time adaptability that this allows is effective even against zero-day attacks and complex new hacking techniques.How AI-powered WAP proactively stops threatsOne of the most significant advantages of AI/ML-powered WAFs is proactive identification and prevention capabilities. Here's how this works:Traffic pattern analysis: AI systems monitor both incoming and outgoing traffic to set up baselines for normal behavior. This can then allow for the detection of anomalies that could show a zero-day attack or malicious activity.Real-time decision making: Machine learning models keep learning from live traffic and detect suspicious activities on the go sans waiting for any updates in the rule set. This proactive approach ensures that businesses are guarded from emerging threats before they escalate.Heuristic tagging and behavioral insights: Advanced heuristics used by AI-driven systems tag everything from sessionless clients to unusual request frequencies. It helps administrators classify potential bots or automated attacks much faster.Ability to counter zero-day attacks: Traditional WAF solutions can only mitigate attacks that are already in the process of accessing sensitive areas. AI/ML-powered WAFs, on the other hand, can use data to identify and detect patterns indicative of future attacks, stopping attackers in their tracks and preventing future damage.Intelligent policy management: Adaptive WAFs detect suspicious activity and alert users to misconfigured security policies accordingly. They reduce the need for manual configuration while assuring better protection.Integrated defense layers: One of the strongest features of AI/ML-powered systems is the ease with which they integrate other layers of security, including bot protection and DDoS mitigation, into a connected architecture that protects several attack surfaces.User experience and operational impactAI-driven WAFs improve the day-to-day operations of security teams by transforming how they approach threat management. With intuitive dashboards and clearly presented analytics, as offered by Gcore WAAP, these tools empower security professionals to quickly interpret complex data, streamline decision-making, and respond proactively to threats.Instead of manually analyzing vast amounts of traffic data, teams now receive immediate alerts highlighting critical security events, such as abnormal IP behaviors or unusual session activity. Each alert includes actionable recommendations, enabling rapid adjustments to security policies without guesswork or delay.By automating the identification of sophisticated threats such as credential stuffing, scraping, and DDoS attacks, AI-powered solutions significantly reduce manual workloads. Advanced behavioral profiling and heuristic tagging pinpoint genuine threats with high accuracy, allowing security teams to concentrate their efforts where they're most needed.Embracing intelligent security with Gcore’s AI-driven WAAPOur AI-powered WAAP solution provides intelligent, interrelated protection to empower companies to actively outperform even the most sophisticated, ever-changing threats by applying advanced traffic analysis, heuristic tagging, and adaptive learning. With its cross-domain functionality and actionable security insights, this solution stands out as an invaluable tool for both security architects and strategic decision-makers. It combines innovation and practicality to address the needs of modern businesses.Curious to learn more about WAAP? Check out our ebook for cybersecurity best practices, the most common threats to look out for, and how WAAP can safeguard your businesses’ digital assets. Or, get in touch with our team to learn more about Gcore WAAP.Learn why WAAP is essential for modern businesses with a free ebook

May 13, 2025 3 min read
Fundamentals

How AI helps prevent API attacks

APIs have become an integral part of modern digital infrastructure, and it can be easy to take their security for granted. But, unfortunately, APIs are a popular target for attackers. Hackers can use APIs to access crucial data and services, and breaching APIs allows attackers to bypass traditional security controls.Most companies focus on speed of development and deployment ahead of security when crafting APIs, making them vulnerable to issues like insecure authentication, poor validation, or misconfigured endpoints, which attackers can abuse. Additionally, the interconnected nature of APIs creates multiple endpoints, widening the attack surface and creating additional points of entry that attackers can exploit.As threats evolve and the attack surface grows to include more API endpoints, integrating AI threat detection and mitigation is an absolute must for businesses to take serious, deliberate action against API cyberattacks. Let’s find out why.Staying ahead of zero-day API attacksOf all the cyber attacks that commonly threaten APIs, zero-day attacks, leveraging unknown vulnerabilities, are probably the toughest to defeat. Traditional solutions rely more on the existence of preconfigured rules or signatures along with human interference to detect and block such attacks. This approach often fails against novel threats and can block legitimate traffic, leaving applications vulnerable and making APIs inaccessible to users.APIs must balance between allowing legitimate users access and maintaining security. AI and ML technologies excel at identifying zero-day attacks based on pattern and behavior analysis rather than known signatures. For instance, heuristic algorithms can detect anomalies, such as sudden spikes in unusual traffic or behaviors indicative of malicious intent.Consider the following example: A certain IP address makes an abnormally large number of requests to a rarely accessed endpoint. Even without prior knowledge of the IP or attack vector, an AI/ML-enhanced solution can flag the activity as suspicious and block it proactively. Using minimal indicators, such as frequency patterns or traffic anomalies, AI can stop attackers before they fully exploit vulnerabilities. Additionally, this means that only suspicious IPs are blocked, and legitimate users can continue to access APIs unimpeded.The risks of shadow APIsOne of the biggest risks is shadow APIs, which are endpoints that exist but aren't documented or monitored. These can arise from configuration mistakes, forgotten updates, or even rogue development practices. These unknown APIs are the ideal target for Layer 7 attacks, as they are often left undefended, making them easy targets.AI-powered API discovery tools map both known and unknown API endpoints, enabling the grouping and management of these endpoints so sensitive APIs can be properly secured. This level of visibility is critical to securing systems against API-targeting attacks; without it, businesses are left in the dark.API discovery as a critical security practiceWAAP with AI/ML capabilities excels in API security because it accurately checks and analyzes API traffic. The Gcore API discovery engine offers 97 to 99 percent accuracy, mapping APIs in users’ domains and using data to recommend policies to help secure APIs.How heuristics enhance WAAP AI capabilities to protect APIsWhile AI and ML form the backbone of modern WAAPs, heuristic methods complement them in enhancing detection accuracy. Heuristics allow the system to inspect granular behaviors, such as mouse clicks or scrolling patterns, which distinguish legitimate users from bots.For example, most scraping attacks involve automated scripts that interact with APIs in predictable and repetitive manners. In those cases, WAAP can use request patterns or user action monitoring to identify the script with high accuracy. Heuristics may define bots by checking how users interact with page elements, such as buttons or forms, and flagging those that behave unnaturally.This layered approach ensures that the most sophisticated automated attack attempts are caught in the net and mitigated without affecting legitimate traffic.Protect your APIs with the click of a button using Gcore WAAPAI offers proactive, intelligent solutions that can address the modern complexities of cybersecurity. These technologies empower organizations to secure APIs against even the most sophisticated threats, including zero-day vulnerabilities and undiscovered APIs.Interested in protecting your APIs with WAAP? Download our ebook to discover cybersecurity best practices, the most prevalent threats, and how WAAP can protect your business’s digital infrastructure, including APIs. Or, reach out to our team to learn more about Gcore WAAP.Discover why WAAP is a must-have for API protection

April 28, 2025 3 min read
Fundamentals

Bare metal vs. virtual machines: performance, cost, and use case comparison

Choosing the right type of server infrastructure is critical to how your application performs, scales, and fits your budget. For most workloads, the decision comes down to two core options: bare metal servers and virtual machines (VMs). Both can be deployed in the cloud, but they differ significantly in terms of performance, control, scalability, and cost.In this article, we break down the core differences between bare metal and virtual servers, highlight when to choose each, and explain how Gcore can help you deploy the right infrastructure for your needs. If you want to learn about either BM or VMs in detail, we’ve got articles for those: here’s the one for bare metal, and here’s a deep dive into virtual machines.Bare metal vs. virtual machines at a glanceWhen evaluating whether bare metal or virtual machines are right for your company, consider your specific workload requirements, performance priorities, and business objectives. Here’s a quick breakdown to help you decide what works best for you.FactorBare metal serversVirtual machinesPerformanceDedicated resources; ideal for high-performance workloadsShared resources; suitable for moderate or variable workloadsScalabilityOften requires manual scaling; less flexibleHighly elastic; easy to scale up or downCustomizationFull control over hardware, OS, and configurationLimited by hypervisor and provider’s environmentSecurityIsolated by default; no hypervisor layerShared environment with strong isolation protocolsCostHigher upfront cost; dedicated hardwarePay-as-you-go pricing; cost-effective for flexible workloadsBest forHPC, AI/ML, compliance-heavy workloadsStartups, dev/test, fast-scaling applicationsAll about bare metal serversA bare metal server is a single-tenant physical server rented from a cloud provider. Unlike virtual servers, the hardware is not shared with other users, giving you full access to all resources and deeper control over configurations. You get exclusive access and control over the hardware via the cloud provider, which offers the stability and security needed for high-demand applications.The benefits of bare metal serversHere are some of the business advantages of opting for a bare metal server:Maximized performance: Because they are dedicated resources, bare metal servers provide top-tier performance without sharing processing power, memory, or storage with other users. This makes them ideal for resource-intensive applications like high-performance computing (HPC), big data processing, and game hosting.Greater control: Since you have direct access to the hardware, you can customize the server to meet your specific requirements. This is especially important for businesses with complex, specialized needs that require fine-tuned configurations.High security: Bare metal servers offer a higher level of security than their alternatives due to the absence of virtualization. With no shared resources or hypervisor layer, there’s less risk of vulnerabilities that come with multi-tenant environments.Dedicated resources: Because you aren’t sharing the server with other users, all server resources are dedicated to your application so that you consistently get the performance you need.Who should use bare metal servers?Here are examples of instances where bare metal servers are the best option for a business:High-performance computing (HPC)Big data processing and analyticsResource-intensive applications, such as AI/ML workloadsGame and video streaming serversBusinesses requiring enhanced security and complianceAll about virtual machinesA virtual server (or virtual machine) runs on top of a physical server that’s been partitioned by a cloud provider using a hypervisor. This allows multiple VMs to share the same hardware while remaining isolated from each other.Unlike bare metal servers, virtual machines share the underlying hardware with other cloud provider customers. That means you’re using (and paying for) part of one server, providing cost efficiency and flexibility.The benefits of virtual machinesHere are some advantages of using a shared virtual machine:Scalability: Virtual machines are ideal for businesses that need to scale quickly and are starting at a small scale. With cloud-based virtualization, you can adjust your server resources (CPU, memory, storage) on demand to match changing workloads.Cost efficiency: You pay only for the resources you use with VMs, making them cost-effective for companies with fluctuating resource needs, as there is no need to pay for unused capacity.Faster deployment: VMs can be provisioned quickly and easily, which makes them ideal for anyone who wants to deploy new services or applications fast.Who should use virtual machines?VMs are a great fit for the following:Web hosting and application hostingDevelopment and testing environmentsRunning multiple apps with varying demandsStartups and growing businesses requiring scalabilityBusinesses seeking cost-effective, flexible solutionsWhich should you choose?There’s no one-size-fits-all answer. Your choice should depend on the needs of your workload:Choose bare metal if you need dedicated performance, low-latency access to hardware, or tighter control over security and compliance.Choose virtual servers if your priority is flexible scaling, faster deployment, and optimized cost.If your application uses GPU-based inference or AI training, check out our dedicated guide to VM vs. BM for AI workloads.Get started with Gcore BM or VMs todayAt Gcore, we provide both bare metal and virtual machine solutions, offering flexibility, performance, and reliability to meet your business needs. Gcore Bare Metal has the power and reliability needed for demanding workloads, while Gcore Virtual Machines offers customizable configurations, free egress traffic, and flexibility.Compare Gcore BM and VM pricing now

April 22, 2025 3 min read
Fundamentals

Optimize your workload: a guide to selecting the best virtual machine configuration

Virtual machines (VMs) offer the flexibility, scalability, and cost-efficiency that businesses need to optimize workloads. However, choosing the wrong setup can lead to poor performance, wasted resources, and unnecessary costs.In this guide, we’ll walk you through the essential factors to consider when selecting the best virtual machine configuration for your specific workload needs.﹟1 Understand your workload requirementsThe first step in choosing the right virtual machine configuration is understanding the nature of your workload. Workloads can range from light, everyday tasks to resource-intensive applications. When making your decision, consider the following:Compute-intensive workloads: Applications like video rendering, scientific simulations, and data analysis require a higher number of CPU cores. Opt for VMs with multiple processors or CPUs for smoother performance.Memory-intensive workloads: Databases, big data analytics, and high-performance computing (HPC) jobs often need more RAM. Choose a VM configuration that provides sufficient memory to avoid memory bottlenecks.Storage-intensive workloads: If your workload relies heavily on storage, such as file servers or applications requiring frequent read/write operations, prioritize VM configurations that offer high-speed storage options, such as SSDs or NVMe.I/O-intensive workloads: Applications that require frequent network or disk I/O, such as cloud services and distributed applications, benefit from VMs with high-bandwidth and low-latency network interfaces.﹟2 Consider VM size and scalabilityOnce you understand your workload’s requirements, the next step is to choose the right VM size. VM sizes are typically categorized by the amount of CPU, memory, and storage they offer.Start with a baseline: Select a VM configuration that offers a balanced ratio of CPU, RAM, and storage based on your workload type.Scalability: Choose a VM size that allows you to easily scale up or down as your needs change. Many cloud providers offer auto-scaling capabilities that adjust your VM’s resources based on real-time demand, providing flexibility and cost savings.Overprovisioning vs. underprovisioning: Avoid overprovisioning (allocating excessive resources) unless your workload demands peak capacity at all times, as this can lead to unnecessary costs. Similarly, underprovisioning can affect performance, so finding the right balance is essential.﹟3 Evaluate CPU and memory considerationsThe central processing unit (CPU) and memory (RAM) are the heart of a virtual machine. The configuration of both plays a significant role in performance. Workloads that need high processing power, such as video encoding, machine learning, or simulations, will benefit from VMs with multiple CPU cores. However, be mindful of CPU architecture—look for VMs that offer the latest processors (e.g., Intel Xeon, AMD EPYC) for better performance per core.It’s also important that the VM has enough memory to avoid paging, which occurs when the system uses disk space as virtual memory, significantly slowing down performance. Consider a configuration with more RAM and support for faster memory types like DDR4 for memory-heavy applications.﹟4 Assess storage performance and capacityStorage performance and capacity can significantly impact the performance of your virtual machine, especially for applications requiring large data volumes. Key considerations include:Disk type: For faster read/write operations, opt for solid-state drives (SSDs) over traditional hard disk drives (HDDs). Some cloud providers also offer NVMe storage, which can provide even greater speed for highly demanding workloads.Disk size: Choose the right size based on the amount of data you need to store and process. Over-allocating storage space might seem like a safe bet, but it can also increase costs unnecessarily. You can always resize disks later, so avoid over-allocating them upfront.IOPS and throughput: Some workloads require high input/output operations per second (IOPS). If this is a priority for your workload (e.g., databases), make sure that your VM configuration includes high IOPS storage options.﹟5 Weigh up your network requirementsWhen working with cloud-based VMs, network performance is a critical consideration. High-speed and low-latency networking can make a difference for applications such as online gaming, video conferencing, and real-time analytics.Bandwidth: Check whether the VM configuration offers the necessary bandwidth for your workload. For applications that handle large data transfers, such as cloud backup or file servers, make sure that the network interface provides high throughput.Network latency: Low latency is crucial for applications where real-time performance is key (e.g., trading systems, gaming). Choose VMs with low-latency networking options to minimize delays and improve the user experience.Network isolation and security: Check if your VM configuration provides the necessary network isolation and security features, especially when handling sensitive data or operating in multi-tenant environments.﹟6 Factor in cost considerationsWhile it’s essential that your VM has the right configuration, cost is always an important factor to consider. Cloud providers typically charge based on the resources allocated, so optimizing for cost efficiency can significantly impact your budget.Consider whether a pay-as-you-go or reserved model (which offers discounted rates in exchange for a long-term commitment) fits your usage pattern. The reserved option can provide significant savings if your workload runs continuously. You can also use monitoring tools to track your VM’s performance and resource usage over time. This data will help you make informed decisions about scaling up or down so you’re not paying for unused resources.﹟7 Evaluate security featuresSecurity is a primary concern when selecting a VM configuration, especially for workloads handling sensitive data. Consider the following:Built-in security: Look for VMs that offer integrated security features such as DDoS protection, web application firewall (WAF), and encryption.Compliance: Check that the VM configuration meets industry standards and regulations, such as GDPR, ISO 27001, and PCI DSS.Network security: Evaluate the VM's network isolation capabilities and the availability of cloud firewalls to manage incoming and outgoing traffic.﹟8 Consider geographic locationThe geographic location of your VM can impact latency and compliance. Therefore, it’s a good idea to choose VM locations that are geographically close to your end users to minimize latency and improve performance. In addition, it’s essential to select VM locations that comply with local data sovereignty laws and regulations.﹟9 Assess backup and recovery optionsBackup and recovery are critical for maintaining data integrity and availability. Look for VMs that offer automated backup solutions so that data is regularly saved. You should also evaluate disaster recovery capabilities, including the ability to quickly restore data and applications in case of failure.﹟10 Test and iterateFinally, once you've chosen a VM configuration, testing its performance under real-world conditions is essential. Most cloud providers offer performance monitoring tools that allow you to assess how well your VM is meeting your workload requirements.If you notice any performance bottlenecks, be prepared to adjust the configuration. This could involve increasing CPU cores, adding more memory, or upgrading storage. Regular testing and fine-tuning means that your VM is always optimized.Choosing a virtual machine that suits your requirementsSelecting the best virtual machine configuration is a key step toward optimizing your workloads efficiently, cost-effectively, and without unnecessary performance bottlenecks. By understanding your workload’s needs, considering factors like CPU, memory, storage, and network performance, and continuously monitoring resource usage, you can make informed decisions that lead to better outcomes and savings.Whether you're running a small application or large-scale enterprise software, the right VM configuration can significantly improve performance and cost. Gcore offers a wide range of virtual machine options that can meet your unique requirements. Our virtual machines are designed to meet diverse workload requirements, providing dedicated vCPUs, high-speed storage, and low-latency networking across 30+ global regions. You can scale compute resources on demand, benefit from free egress traffic, and enjoy flexible pricing models by paying only for the resources in use, maximizing the value of your cloud investments.Contact us to discuss your VM needs

April 17, 2025 5 min read
How-tos

11 simple tips for securing your APIs

A vast 84% of organizations have experienced API security incidents in the past year. APIs (application programming interfaces) are the backbone of modern technology, allowing seamless interaction between diverse software platforms. However, this increased connectivity comes with a downside: a higher risk of security breaches, which can include injection attacks, credential stuffing, and L7 DDoS attacks, as well as the ever-growing threat of AI-based attacks.Fortunately, developers and IT teams can implement DIY API protection. Mitigating vulnerabilities involves using secure coding techniques, conducting thorough testing, and applying strong security protocols and frameworks. Alternatively, you can simply use a WAAP (web application and API protection) solution for specialized, one-click, robust API protection.This article explains 11 practical tips that can help protect your APIs from security threats and hacking attempts, with examples of commands and sample outputs to provide API security.#1 Implement authentication and authorizationUse robust authentication mechanisms to verify user identity and authorization strategies like OAuth 2.0 to manage access to resources. Using OAuth 2.0, you can set up a token-based authentication system where clients request access tokens using credentials. # Requesting an access token curl -X POST https://yourapi.com/oauth/token \ -d "grant_type=client_credentials" \ -d "client_id=your_client_id" \ -d "client_secret=your_client_secret" Sample output: { "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...", "token_type": "bearer", "expires_in": 3600 } #2 Secure communication with HTTPSEncrypting data in transit using HTTPS can help prevent eavesdropping and man-in-the-middle attacks. Enabling HTTPS may involve configuring your web server with SSL/TLS certificates, such as Let’s Encrypt with nginx. sudo certbot --nginx -d yourapi.com #3 Validate and sanitize inputValidating and sanitizing all user inputs protects against injection and other attacks. For a Node.js API, use express-validator middleware to validate incoming data. app.post('/api/user', [ body('email').isEmail(), body('password').isLength({ min: 5 }) ], (req, res) => { const errors = validationResult(req); if (!errors.isEmpty()) { return res.status(400).json({ errors: errors.array() }); } // Proceed with user registration }); #4 Use rate limitingLimit the number of requests a client can make within a specified time frame to prevent abuse. The express-rate-limit library implements rate limiting in Express.js. const rateLimit = require('express-rate-limit'); const apiLimiter = rateLimit({ windowMs: 15 * 60 * 1000, // 15 minutes max: 100 }); app.use('/api/', apiLimiter); #5 Undertake regular security auditsRegularly audit your API and its dependencies for vulnerabilities. Runnpm auditin your Node.js project to detect known vulnerabilities in your dependencies.  npm audit Sample output: found 0 vulnerabilities in 1050 scanned packages #6 Implement access controlsImplement configurations so that users can only access resources they are authorized to view or edit, typically through roles or permissions. The two more common systems are Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) for a more granular approach.You might also consider applying zero-trust security measures such as the principle of least privilege (PoLP), which gives users the minimal permissions necessary to perform their tasks. Multi-factor authentication (MFA) adds an extra layer of security beyond usernames and passwords.#7 Monitor and log activityMaintain comprehensive logs of API activity with a focus on both performance and security. By treating logging as a critical security measure—not just an operational tool—organizations can gain deeper visibility into potential threats, detect anomalies more effectively, and accelerate incident response.#8 Keep dependencies up-to-dateRegularly update all libraries, frameworks, and other dependencies to mitigate known vulnerabilities. For a Node.js project, updating all dependencies to their latest versions is vital. npm update #9 Secure API keysIf your API uses keys for access, we recommend that you make sure that they are securely stored and managed. Modern systems often utilize dynamic key generation techniques, leveraging algorithms to automatically produce unique and unpredictable keys. This approach enhances security by reducing the risk of brute-force attacks and improving efficiency.#10 Conduct penetration testingRegularly test your API with penetration testing to identify and fix security vulnerabilities. By simulating real-world attack scenarios, your organizations can systematically identify vulnerabilities within various API components. This proactive approach enables the timely mitigation of security risks, reducing the likelihood of discovering such issues through post-incident reports and enhancing overall cybersecurity resilience.#11 Simply implement WAAPIn addition to taking the above steps to secure your APIs, a WAAP (web application and API protection) solution can defend your system against known and unknown threats by consistently monitoring, detecting, and mitigating risks. With advanced algorithms and machine learning, WAAP safeguards your system from attacks like SQL injection, DDoS, and bot traffic, which can compromise the integrity of your APIs.Take your API protection to the next levelThese steps will help protect your APIs against common threats—but security is never one-and-done. Regular reviews and updates are essential to stay ahead of evolving vulnerabilities. To keep on top of the latest trends, we encourage you to read more of our top cybersecurity tips or download our ultimate guide to WAAP.Implementing specialized cybersecurity solutions such as WAAP, which combines web application firewall (WAF), bot management, Layer 7 DDoS protection, and API security, is the best way to protect your assets. Designed to tackle the complex challenges of API threats in the age of AI, Gcore WAAP is an advanced solution that keeps you ahead of security threats.Discover why WAAP is a non-negotiable with our free ebook

April 14, 2025 3 min read

Subscribe to our newsletter

Get the latest industry trends, exclusive insights, and Gcore updates delivered straight to your inbox.

Subscribe