How to harden a database against sudden traffic surges

One e-commerce CEO’s digital dream—a million site visitors in a day, all purchasing products!—is another site admin’s nightmare, especially if that IT pro hasn’t yet tested whether the platform and databases can handle a mob of lively leads.

A product launch or a flash sale often results in lots of new clicks from lots of new customers. A database “read” application request retrieves information and a “write” adds, changes, or removes data.

Off base! A database, like a tired parent, gets overloaded and ultimately breaks down when faced with lots of queries at once. One important countering strategy, according to Douglas Barahona, lead systems engineer at digital transformation agency Fueled, is to prevent queries from reaching the database where possible.

“The strategy starts way before the request gets to the database,” he said, noting these important safeguards.

• You take cache? With content delivery network (CDN) providers like Cloudflare and Akamai, teams can cache, or store copies of, content on edge servers. Cached responses offer read-only duplicates that are valuable for not-likely-to-change data sets like product categories, Barahona told us. Identifying what can be cached at the CDN layer is a first layer of database load reduction.
• WAF! CDN services also offer web application firewall capabilities to inspect suspicious traffic, as well as rate limits and CAPTCHAs to detect bots.
• Object work. Object caching, provided by services like Redis and Memcached, stores database queries in the temporary workspace of memory so that new requests can be quickly accessed. Users can target read-heavy, slow-changing queries (ones involving those product and category lists, for example) for this feature.
• Copy that. Make sure read requests are pulled from a replica, backup database, advises Barahona, which reduces pressure on the main database.

Spread out. Spencer Kimball, CEO at Cockroach Labs, maker of the distributed SQL database CockroachDB, sees value in serverless services like AWS Lambda and Google’s Cloud Run, which IT pros can use to create scalable container instances to accommodate a sudden increase in traffic requests. (While those platforms provide scalable compute, Cockroach Labs offers scalable databases.)

Additional resources can solve an immediate spike, but Barahona sees strategic advantage in fine-tuning one’s current infrastructure—keeping a database at a reasonable utilization level and caching where possible, for example—before that kind of emergency arises.

“You want the site back up and running as quickly as possible. You want users to continue shopping and do everything about their operation, but you need to optimize,” Barahona said.

Testing, testing. A load test simulates the mob with a surge of logins, navigation, and other user behaviors to determine how many requests a system can handle. These tests are often done in replica environments, or a new platform before it goes live. While vendors offer load tests as part of their services, Kimball sees advantages with using AI, such as pointing an LLM at source code and asking it to formulate a plan for load testing.

“I think relying on AI for something like this is actually a really good starting point,” he said. “Now you want to review that plan. You want to make sure it makes sense in your context and that it captures your real customer behaviors. But you iterate on that prompt.”

Find the limits. Once a load test reveals breaking points and capacity limits, a data pro can address them. For example, a query that joins several tables, scans more rows than necessary, lacks appropriate indexes, or retrieves more information than the application needs can be restructured and optimized, Barahona suggested. Or if you discover that 50,000 concurrent users break the site, perhaps send a message after the 30,000th visitor effectively saying, “Hey, try again in a bit,” Kimball advised.

There’s certainly a degradation in service with this fallback option, Kimball said, but it isn’t a complete collapse: “If you don’t do something like that, what happens is everything seizes up, and nobody gets through.”

Talk to my agent. And if you think human buyers are a lot, imagine agents. Agents and bots, for the first time ever, surpassed human-generated traffic in June of this year, according to Cloudflare. (As of July 21, Cloudflare has bots and agents making up 59% of HTTP requests, compared to 41% of human-driven traffic.)

AI is set to make this traffic-surge problem “much, much worse,” according to Kimball.

“Agents work at machine speed. They’re very exhaustive. They don’t stop,” he said.

Barahona advises companies to think of agentic transactions as a growing category of machine-driven traffic—one that IT pros will need to identify, monitor, and control at the CDN layer with tools like web application firewalls and rate limits.

Barahona’s team has been implementing rules based on a bot score and observed traffic patterns.

“The goal is not necessarily to block all automated traffic. Known and useful agents can be rate-limited so they operate within the site’s capacity, while malicious, abusive, or unwanted agents can be blocked,” he wrote in a follow-up email to IT Brew.