DDoS attack

A DDoS attack does not break into a site or steal data. Its goal is disruption: overwhelm the server, the network connection or the application until it slows to a crawl or stops responding. The "distributed" part matters. Traffic comes from thousands of different machines, usually a botnet of infected computers, routers and smart devices, so blocking a single address does not help.

It is easy to confuse a DDoS attack with a sudden surge of genuine visitors, for example after a TV mention. Both can take a site down. The difference is intent and pattern: attack traffic is often repetitive, comes from unusual places and hits the same pages or requests again and again.

How it works

Attacks fall into three broad types. Volumetric attacks fill the network connection with sheer amounts of data. Protocol attacks exhaust the resources of servers, firewalls or load balancers with malformed or half-open connections. Application-layer attacks send requests that look normal, such as repeated searches or login attempts, which are cheap to send but expensive for the site to answer, because each one makes the server run code or query a database.

Attackers rent botnets cheaply, so the cost of launching an attack is low and the targets are often random, competitive or extortion-driven. Some send a ransom note threatening a larger attack unless paid.

Protection works by putting a large network in front of your site. A CDN or dedicated DDoS protection service receives all traffic first, absorbs volumetric floods across its global capacity, filters known bad patterns and challenges suspicious visitors before passing clean traffic to your server. A web application firewall and rate limits, which cap how many requests one source can make in a period, help against application-layer attacks. Caching pages at the edge also means many requests never reach your server at all.

Example

A small online shop on shared hosting goes offline for several hours on a weekend. The host's logs show tens of thousands of requests per minute hitting the search page from addresses across many countries. Each search forces a database query, and the shared server cannot keep up.

The shop moves its DNS behind a CDN with DDoS protection, sets a rate limit on search and login, and caches product pages. When a similar attack comes a month later, the CDN filters it and real customers notice nothing. The owner keeps the host's contact details and the CDN's "under attack" setting documented so either can be switched on quickly.

Why it matters for your business

Downtime during an attack means lost sales, missed bookings and a poor impression, and it often happens at the worst moment, such as a sale or launch. Most small sites will never face a targeted attack, but untargeted ones and bot floods are common. Basic protection is often included with good hosting or available on CDN free tiers, so the cost is mostly setup time. Large, sustained attacks need paid services. Check what your host does when an attack hits: some protect you, others simply take the site offline to protect their other customers. Keep uptime monitoring in place so you hear about outages before customers do.

Common mistakes

• Assuming a small business is too unimportant to be hit, when many attacks are automated and indiscriminate.
• Leaving the origin server's real IP address publicly visible, so attackers can bypass the CDN and hit it directly.
• Paying a ransom demand, which marks you as a willing target and does not guarantee the attacks stop.
• Having no plan for who to call and what to switch on when the site goes down.

Questions people ask

Can a DDoS attack steal my data?

Not by itself. A DDoS attack aims to make a service unavailable, not to access data. However, attackers sometimes use one as a distraction while attempting a break-in elsewhere, so review logs and security alerts after an attack.

How long does a DDoS attack last?

Anywhere from a few minutes to several days. Many are short bursts, while extortion campaigns may repeat over weeks. With protection from a CDN or specialist service, the attack may continue but your visitors stop noticing it.

How do I protect a small website from DDoS attacks?

Put the site behind a CDN or hosting provider that includes DDoS protection, hide your server's real IP address, enable rate limiting on expensive pages such as search and login, cache what you can and set up uptime monitoring so you know quickly when something goes wrong.