Methods and systems for using ephemeral URL passwords to deter high volume attacks is described. A request to access one of several protected URLs is detected from a client computing device. A URL password is received from the client computing device. The request is redirected to the protected URL upon determining that the received URL password is valid for the one of the several of protected URLs.