A distributed denial-of-service (DDoS) attack tries to make a website, app or online service unavailable by flooding it with more traffic or requests than it can handle, sent from many devices at once. The aim is usually to keep real customers out, not to steal data: the booking page times out or the online shop stops loading.
"Distributed" means the traffic comes from many sources, often compromised computers, routers, cameras or cloud servers controlled together as a "botnet". Because requests arrive from so many addresses, blocking one IP address rarely solves the problem.
Common types of DDoS attack
Attacks are usually grouped by which part of your setup they try to exhaust. One attack can combine several types.
- Volumetric attacks: send a huge amount of traffic to fill the network connection to your server or hosting provider.
- Protocol attacks: abuse the way network connections are set up, for example by opening many half-finished connections, so servers, firewalls or load balancers run out of capacity to track them.
- Application-layer attacks (HTTP floods): send requests that look like normal visitors, such as repeatedly loading a search page, login form or booking calendar. If each request triggers heavy database work, a modest number can slow or stop the application.
HTTP floods matter for SMEs because they can look like a genuine rush of customers.
Signs of a possible DDoS attack
- The website or app becomes very slow or unavailable, while your own internet connection works normally.
- A sudden traffic spike that does not match a campaign, launch or normal busy period.
- Many requests to the same page or endpoint, or from unusual countries or networks.
- Server CPU, memory or database load rises sharply, or your hosting or CDN dashboard shows unusual error rates.
Not every outage is an attack. A faulty update, an expired certificate, a DNS problem or genuine demand can look similar, so check the basics first.
How protection works
No single tool stops every DDoS attack. Protection comes in layers, and much of it sits with your providers rather than on your own server.
- CDN: a content delivery network serves your site from many edge locations and can absorb a large share of traffic before it reaches your origin server. Many CDNs include some DDoS mitigation.
- WAF: a web application firewall inspects HTTP requests and can block or challenge suspicious patterns, which helps against HTTP floods.
- Rate limiting: caps how many requests one source can make to a page or API in a set period, for example on login, search or booking endpoints.
- Hosting and cloud provider protection: many hosting companies and cloud platforms provide basic network-level protection, and some offer advanced plans with more capacity and support during an attack. What is included varies, so check your plan.
- Origin protection: keep your server's real address private where possible, so attackers cannot bypass the CDN and hit it directly.
In cloud services, duties are split between you and the provider; the shared responsibility model explains who handles which part.
Preparing your response
An attack is easier to handle when the plan exists before it starts. Add DDoS to your incident response plan:
- Contacts: who to call at your hosting company, CDN, DNS provider and IT partner, including out-of-hours routes and your account IDs.
- Runbook: simple steps for switching on stricter CDN or WAF modes, adding rate limits or a visitor challenge, and who may make those changes.
- Monitoring: uptime checks from several locations through website monitoring, plus alerts on traffic, error rates and server load, so you hear about problems before customers do.
- Communication: a short message for customers and staff, and another way to take bookings if the main system is down.
After any incident, keep the logs, note what worked and update the runbook.
What to ask your hosting or cloud provider
- What DDoS protection is included in our plan, and at which layers: network, protocol or application?
- Is protection always on, or does it need to be activated during an attack?
- What happens to our service and our bill if we receive a very large traffic spike?
- How do we report a suspected attack, and what response times apply out of hours?
- Can our origin server be set to accept traffic only from the CDN or load balancer?
Frequently asked questions
Would attackers really target a small business?
It can happen. Some attacks target a specific company, while others hit a shared hosting provider or network and affect every site on it.
Does a DDoS attack mean our data was stolen?
Not by itself. DDoS targets availability rather than data. It is sometimes used as a distraction, so review logins and security alerts during and after an attack.
Can we stop a DDoS attack on our own server?
Usually only small ones. Large floods need to be filtered upstream by your CDN, hosting or cloud provider before they reach your server.
Should we pay if someone demands money to stop an attack?
Contact your providers and IT partner first, and consider reporting the demand to the police. Paying does not guarantee the attack will stop.
If you want help reviewing how your website, booking system or cloud services are protected, see our cybersecurity and compliance services. For ongoing monitoring and maintenance with agreed response times, see managed support and SLA.