At 19:47 UTC on an ordinary Thursday, one of our monitored pop campaigns got hit by a flood: 32 placements went bad simultaneously, 513 bot visits in a single five-minute window. Two days later it happened again — 40 placements, 973 blocked visits, one burst.
Zone blocking handles slow rot. It does not handle floods — by the time each placement individually accumulates enough evidence to block, the burst has billed you. What handles floods is a different tool, borrowed from electrical engineering: a circuit breaker.
What a campaign circuit breaker is
The idea: when verified bad traffic spikes abnormally across many placements at once — a pattern no organic traffic produces — the system pauses the affected campaigns through the network's own API, immediately, before the flood finishes. Then a human decides when to resume.
Simple to say. The engineering that makes it safe to trust with your money is where every naive implementation fails. Here is what we learned building one.
Rule 1: never trigger on a raw count
“Pause if 30 bad events in 5 minutes” sounds reasonable until you do the math: 30 bad events out of 100,000 visits is 0.03% noise; 30 bad events out of 35 visits is an attack. A safe trigger needs volume AND concentration together — a minimum number of simultaneously-failing placements, a minimum bad-event count, and a minimum bad-share per placement (we use ≥80% blocked within the window). We back-tested the thresholds against months of real traffic: the trigger that fires on genuine floods and produced zero false fires fired exactly twice in four days — on the two real attacks above.
Rule 2: only fresh events, by original timestamp
Here is the failure mode nobody thinks about: your data pipeline hiccups, a backlog of old events processes all at once, and your breaker sees “a thousand bad events this minute” — from traffic that arrived days ago. If the breaker counts processing time instead of arrival time, a pipeline hiccup pauses your healthy campaigns. Ours only counts events whose original arrival timestamp falls inside the live window, and it refuses to act at all if its own data pipeline reports unhealthy. We verified this the hard way: a three-day verdict backlog cleared through our system in one burst — and produced zero triggers.
Rule 3: verify the pause actually happened
An API returning 200 is a promise, not a fact. After every pause write, the breaker independently re-reads the campaign from the network and confirms the state really changed. A write that acknowledges but does not stick raises a loud “pause unconfirmed” alarm — because believing you are paused while you are billing is worse than never pausing.
Rule 4: never auto-resume, never re-fire
The breaker pauses once per incident (with a cooldown so one flood cannot re-fire it every minute) and never restarts a campaign on its own. Resuming is a money decision with context a machine does not have — was it the network? one bad supplier? is it over? The breaker's job is to stop the bleeding and hand you a complete incident report: window, placements, counts, bad-share, what it did, and whether the network confirmed it.
Alert-first is a feature, not a compromise
One more honesty note: on networks whose APIs cannot pause a campaign (or cannot prove they did), the breaker should say so and fall back to instant alerting — not pretend. A protection system that overstates its own powers is just a second source of bad data. Detection and alerting run everywhere; automatic pausing runs only where the write path is certified.
FAQ
Can't I just set a daily budget cap instead?
Caps bound the damage per day; they do not stop a flood at minute five. The two are complementary — a cap is your seatbelt, the breaker is your airbag.
What if the flood is on one placement only?
Single-placement bursts are handled by zone-level quarantine — faster and narrower than pausing a campaign. The breaker exists for the multi-placement pattern that zone tools are structurally too slow for.
Why not auto-resume after the flood ends?
Because “the flood ended” is indistinguishable from “the campaign is paused so no traffic is arriving.” A machine that resumes on absence-of-evidence will resume into the middle of the attack. Humans resume; machines stop.