What is Slowloris?

Slowloris is a slow HTTP denial-of-service technique that keeps many web server connections open by sending incomplete requests very slowly. Instead of overwhelming bandwidth, it exhausts connection slots, threads, or request-handling capacity at the application layer.

For teams asking “What is Slowloris” during a web outage review, the key point is that a small amount of traffic can create disproportionate impact when servers wait too long for unfinished HTTP headers. The main risk is service disruption, not direct data theft.

How does it work?

A Slowloris attack opens numerous HTTP connections and sends partial request headers at intervals designed to keep each connection alive. Vulnerable servers reserve resources for those sessions while legitimate users wait, time out, or receive errors.

Defensive controls usually focus on timeouts, connection limits, reverse proxies, load balancers, WAF rules, rate limits, and monitoring for unusually long-lived incomplete requests.

Slowloris vs HTTP flood

Slowloris and HTTP floods are both application-layer DDoS attacks, but they stress servers differently. An HTTP flood sends many complete requests quickly, while Slowloris relies on slow, incomplete requests that consume open connection capacity.

That difference affects mitigation. HTTP floods often require traffic volume analysis and request filtering, while Slowloris defense depends heavily on sane server thresholds, idle connection handling, request header timeouts, and upstream protection.

How Hexnode supports Slowloris defense

Hexnode does not replace edge DDoS controls, WAFs, or web server hardening. It supports the endpoint security side of readiness by helping teams maintain compliance status, enforce browser restrictions, manage application controls, and run patch workflows across managed devices.

This matters when administrators need consistent device hygiene during an availability incident. Hexnode can help reduce endpoint misconfiguration, keep administrative workstations updated, and support remote actions when IT teams need to respond quickly.

When should organizations use it?

Organizations should prepare for Slowloris when they operate internet-facing applications, APIs, portals, or services where downtime affects customers, employees, or regulated operations. In this context, “use it” means applying defensive testing and mitigation controls, not running attacks.

Slowloris risk should be reviewed during web server hardening, incident response planning, third-party hosting assessments, and resilience testing for business-critical applications.