Cybersecurity glossary
What is Slowloris?
Learn what a Slowloris attack is, how slow or partial HTTP headers exhaust web server connections, how it differs from volumetric DDoS, and how to detect and mitigate application-layer denial of service.
Definition
Slowloris is an application-layer denial-of-service technique that opens many HTTP connections to a target and keeps them open by sending headers or body data extremely slowly—or never finishing the request—so worker threads or connection slots stay occupied until legitimate clients are starved.
Why Slowloris matters
Availability is a security property. Slowloris shows that you do not need a huge botnet to take a site offline—only enough incomplete HTTP conversations to exhaust concurrent connections. Ops teams often look for traffic spikes; Slowloris can look quiet while users time out.
Web servers, API gateways, and reverse proxies that wait politely for full requests become the bottleneck. Connection pools fill; health checks fail; cascading outages follow.
How a Slowloris attack works
Open many connections
The attacker establishes numerous TCP/TLS sessions to the HTTP listener or front proxy.
Send partial headers
Incomplete request lines or headers arrive slowly so the server never considers the request finished.
Hold slots open
Workers, threads, or connection objects stay allocated waiting for the rest of the request.
Starve legitimate clients
New users cannot obtain a free slot; the service appears down despite low bandwidth use.
Patterns and variants to recognize
Slow headers
Classic Slowloris drips header lines and never sends the final blank line that ends headers.
Slow body
Declared Content-Length with a trickle of body bytes pins the same connection budget.
Read timeouts abused
Long idle or header-read timeouts turn politeness into an amplification of attacker effort.
Shared frontends
One slow client pool can impact many tenants behind a shared reverse proxy if limits are global.
Controls that reduce Slowloris risk
| Control | Notes |
|---|---|
| Request timeouts | Bound header and body read times; fail incomplete requests quickly |
| Minimum data rate | Drop clients that send below a bytes-per-second threshold |
| Per-IP connection caps | Limit concurrent connections and pending requests per client identity |
| Reverse proxy buffering | Terminate slow clients at the edge before they pin app workers |
| Event-driven frontends | Prefer architectures that multiplex many idle sockets efficiently |
| Load shedding | Return 503 under connection pressure instead of hanging forever |
- Document HTTP header/body timeouts on every public listener and reverse proxy.
- Enforce minimum request transfer rates where the stack supports them.
- Cap concurrent connections and pending requests per IP or authenticated client.
- Load-test incomplete-header and slow-body scenarios, not only high RPS floods.
- Alert on rising pending connections with flat or low bandwidth.
- Place a hardened edge proxy in front of app servers that hold threads per request.
- Review shared multi-tenant frontends for cross-tenant connection starvation.
- Include Slowloris-style availability abuse in incident runbooks and tabletop exercises.
The practical takeaway
Slowloris is slow, incomplete HTTP used as application-layer DoS. Cap how long and how slowly a client may occupy a connection, terminate requests at a hardened edge, and treat connection exhaustion like any other resource-exhaustion incident—not only as a volumetric DDoS problem.
Related security terms
Denial of Service (DoS)
Broader category of attacks that deny availability to legitimate users.
Distributed Denial of Service (DDoS)
Availability attacks amplified across many sources; Slowloris is often low-bandwidth.
Resource Exhaustion
Depleting finite server resources such as connections, memory, or CPU.
Unrestricted Resource Consumption
API and app patterns that let callers consume unbounded server capacity.
Frequently asked questions
What is Slowloris in simple terms?
The attacker opens many connections and dribbles incomplete HTTP requests so the server keeps waiting. Once connection slots fill up, real users cannot get through.
Is Slowloris a volumetric DDoS attack?
No. Classic Slowloris uses relatively little bandwidth. It targets connection handling and request timeouts at the application or web-server layer rather than saturating network pipes.
Which servers are most vulnerable?
Thread- or connection-per-request designs with generous timeouts (historically Apache prefork-style setups) are more exposed. Event-driven servers can still be affected if limits and timeouts are weak.
How does Slowloris differ from a slow POST / RUDY attack?
Slowloris typically stalls incomplete headers. Slow POST / RUDY variants send a body extremely slowly after headers declare a large Content-Length. Both exhaust concurrent capacity.
Can a WAF stop Slowloris?
Some WAFs and reverse proxies help by enforcing minimum data rates, max concurrent connections per IP, and request timeouts. Misconfigured edge layers can still pass slow clients through.
What are practical mitigations?
Short request timeouts, minimum transfer rates, connection limits per client, reverse-proxy buffering, and architectures that do not hold a worker captive for incomplete requests.
Is Slowloris still relevant today?
Yes. Variants appear against APIs, load balancers, and misconfigured reverse proxies whenever incomplete requests can pin scarce concurrent slots.
References
Explore authoritative guidance and frameworks related to slowloris.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.