Question: Hi I just wanted some feedback on a DDOS preventing php script that I'm designing. It quite simple and I wanted some feedback on whether you guys think it would be effective.

I'm currently using the [ulogin framework](http://ulogin.sourceforge.net/) as a base and have implemented API Key's. At the moment the user will send a request with a key. This key is checked against the database to see if it correct. So if the key is not correct the program will return.

If the key is correct then some statistics are going to be calculated. The first thing is to increment the counter. The average hit per second will be calculated from the time they started requesting to the current time. Also there is a window of X seconds in which the counter will be reset (Lets say 300). The programmer specifies the max number of requests that should be allowed in this window. If the key is over the limit of requests per stats reset (Window) or over a certain amount of requests per second, they will be blocked and not given access. However the counter still increments but another counter is started (blockcount). 

When the counter is set to 0 at the end of the window, the count for the next window will be set to what ever the blockcount is and the blockcount will be set to 0. If the user doesn't use the API key for X (window) seconds then both counters will be reset to 0. 

I have added a transferpenalty variable (0-1) that will take a percentage of the blockcount on to the next window instead of the entire block count but I don't think that it is neccessary to have this.

Is this already being done? Would this protect against a sniffed API key being used to (D)DOS a server? What are your thoughts :)

Answer: 
Your code is good for monitoring users activity on the server but to be honest, It can't help preventing DDOS attacks since the aim of DDOS attacks is to send tons of requests to the server to make it too busy to respond to its intended users.  

your code seems to be doing lots of checking to determine if the number of requests has reached beyond your standards, and this means that not only the attacker has reached his goal keeping your server busy but also you are helping him with lots of processing which is done by your code.  

Imagine that each time there is a request, your code has to search through database and retrieve information and then compare them and do lots of other stuff.  

there is nothing you could do in PHP to stop this kind of attacks.
and also if the attacker uses UDP attack, your code will do nothing since the Apache listens to TCP port.
The only thing that can protect your website from DDOS attacks is your Hosting company. the company needs to have needed equipments like: 

1. Firewalls
2. rate-limiting Switches
3. appropriate Routers
4. Application front end hardware
5. IPS based prevention
6. DDS based defense
7. Blackholing and sinkholing
8. Clean pipes

but if you need a secure login system you could use a captcha, even the one you created yourself. simply generate a random 5 digit number and create an image in PHP with the number printed in it and show the picture on the form and when the user submits the form, check if the number you generated matches with the one user entered. and also you can use PHP/JavaScript AES libraries to encrypt user inputs on the client side and decrypt them on the server.
the hosting company won't do a lot for you in terms of DDoS. As soon as it gets to large (which with most hosting is small) and/or floods the ISP they will blackhole you. Try something like Prolexic or Akamai (the later doing API with their new release). good luck.