HTTP DDoS is a denial-of-service attack that floods a web application with HTTP requests, usually at the application layer rather than the network layer. The requests may look normal at first glance, but they are sent in volumes that force servers, load balancers, or application code to spend resources on each one.
This matters because web requests are often cheap for an attacker to generate and expensive for a defender to process. A site may still have enough bandwidth while its application becomes slow or unavailable. In real attacks, defenders respond with rate limiting, bot detection, caching, challenge systems, and traffic filtering to separate real users from abusive request floods. HTTP DDoS is especially important in modern environments because many critical services depend on web applications, APIs, and cloud front ends that can be stressed long before the underlying network is saturated.