What is Waiting Room; how does it differ from an attack enforcement?

Short answer

Waiting Room is a capacity tool that limits with a ceiling the number of visitors served at the same time on an HTTP vService and, when the ceiling is full, takes newcomers into a queue without rejecting them and shows them a waiting page. Its purpose is not to sift out malicious traffic but to keep the Backend Services standing during legitimate demand bursts such as ticket sales or a campaign launch; a visitor whose turn comes is taken inside in the order of arrival. Attack enforcements (Block, Silent Drop, Quarantine, Show Captcha), on the other hand, stop or challenge the request because it is suspicious. Waiting Room is opened from the Waiting Room card on the Bot/DDoS Management screen; its default mode is Off, the default Maximum Concurrent Visitors value is 1000, and the visitors are tracked with a signed cookie.

Where It Is Used in TR7

Where	Field / label	What for
Left Monitor Panel → Bot/DDoS Protected vServices → vService → Bot/DDoS Management	Waiting Room card	The mode, capacity and current occupancy of the room
Waiting Room card → pencil icon	Waiting room (Off · Monitor · Active), Maximum concurrent visitors, Waiting page, Idle Timeout (default 5 minutes)	The settings of the room
Waiting Room card	Waiting room — inside / Waiting room — queue tables	The visitors inside and in the queue
Bot/DDoS → Dashboard	Waiting Room — Occupancy & Capacity, Waiting Room — Admissions & Queueing panels	The trend of occupancy, admissions and the queue

Difference from an Attack Enforcement

	Waiting Room	Attack enforcement (Block, Silent Drop, Quarantine, Show Captcha)
What triggers it	When the number of concurrent visitors reaches the ceiling; if Surge Protection (new visitors/min) is defined (default empty, off), also when the number of new visitors per minute exceeds this value	When the request or the source is caught by a protection rule
What happens to the visitor	Sees a waiting page and is taken inside when the turn comes	Is blocked, left without a response, kept outside for a limited time, or asked to solve a CAPTCHA
Whom it targets	Everyone; even legitimate visitors wait	The suspicious or malicious client
In Monitor mode	No one is made to wait; only how many people would enter the queue is measured	No action is applied; an event record is produced

Common Misconceptions

• "Waiting Room is a type of DDoS protection." It is a capacity tool; it does not reject the visitor, it takes the visitor into the queue. Volume attacks are handled by L7 DDoS Protection.
• "Waiting Room is also used on an L7 TCP vService." Since the room relies on showing a waiting page and writing a cookie, it exists only on an HTTP vService.
• "A waiting visitor loses the place in the queue when refreshing the page." The place is carried with a signed cookie written to the browser; a visitor who deletes the cookie or comes from another browser is put at the end of the queue.
• "Search engine crawlers also enter the queue." Verified bots skip the queue is on by default; verified crawlers do not see the waiting page.

How it is done in the documentation

• Waiting Room · What Is Waiting Room?
• Waiting Room · The Waiting Room Edit Screen
• Waiting Room · Waiting Page

Related questions

• What is Quarantine; how does it differ from blocking and where is it used in TR7?
• What is a CAPTCHA; in which protections is it used in TR7?
• What is Application DoS; how does it differ from volumetric DDoS?