Running resilience tests only in staging limits what you learn: production traffic patterns, CDN and WAF behavior, and real user impact are different. On the other hand, testing in production without a plan can cause unnecessary downtime and confusion.
A practical approach is to validate scenarios and tooling in staging (Engarde DDoS and LoadEng work in both), then schedule short, announced production test windows. Define scope (target URLs or IPs), duration, max intensity, and rollback criteria. Notify internal stakeholders and, if needed, customers.
Use low intensity at the start of each production window and increase gradually while watching metrics. Have a clear "abort" owner and a post-test review to update runbooks and thresholds. Engarde DDoS "End test" and LoadEng stop controls let you cut traffic immediately if something unexpected happens.
Document each test (date, target, parameters, outcome) for audits and for improving the next run. Our documentation and training pages cover scenario design and report usage for both products.
For detailed steps, see our documentation and training center pages. Documentation · Training. For product-level details, see Engarde DDoS and LoadEng.