DDoS attacks: what they are, how to recognise one and how to protect your site

A DDoS attack (Distributed Denial of Service) is an attempt to make a website or service unavailable by flooding it with traffic. Imagine a shop where thousands of people who do not want to buy anything crowd the door, so real customers cannot get in. The "crowd" is a network of infected computers and devices, called a botnet, which the attacker controls.

The aim is rarely to steal data. It is to cause downtime, to demand money, to hurt a competitor or to distract your IT team from a second attack.

How to tell you are under attack

• The site becomes very slow or does not open at all, although nothing changed.
• Traffic suddenly jumps from a few countries or addresses, often at night, with no matching increase in orders.
• The server uses almost all its processor or memory, or runs out of connections.
• Your hosting provider sends a warning about unusual load.
• Customers report that they cannot reach you.

Be careful: a sudden success such as a viral post or a big campaign can look the same. Check your analytics and logs before you decide.

Why people order attacks

• Extortion: "pay, or we keep the shop down".
• Unfair competition, especially before sales seasons.
• Revenge or activism.
• A smokescreen while something else is hacked.

Main types

• Volume attacks (such as UDP and ICMP floods): fill the whole connection with junk traffic.
• Protocol attacks (such as SYN flood): exhaust the server's ability to open new connections.
• Application attacks (HTTP flood, slow connections like Slowloris): look like normal visitors but overload the website itself, for instance with thousands of search or login requests.

Application attacks are the hardest to spot, because each request looks innocent.

How to protect your site

1. Put a protection layer in front of the site. A CDN or a DDoS-protection service (many offer a free or cheap plan) absorbs junk traffic and passes only real visitors. For most small businesses this is the single most effective step.
2. Choose hosting with protection included and ask what it covers and what happens during an attack.
3. Use a web application firewall (WAF) with rate limits, so one address cannot send hundreds of requests per second.
4. Cache pages so that most requests are served without heavy work from your server.
5. Hide your real server address, for example behind the CDN, and do not leave old direct addresses open.
6. Keep software updated and close services you do not use.
7. Have spare capacity, so a normal peak does not bring the site down.
8. Monitor and alert. Get a message when the site is down or load jumps, so you react in minutes.

What to do during an attack

1. Confirm that it is an attack and not a normal peak.
2. Contact your hosting or protection provider at once.
3. Turn on the strictest protection mode and block the obvious sources.
4. Tell your team and customers calmly: a short notice on social media or by email avoids panic.
5. Save logs for later analysis, and for the police if the attack comes with a ransom demand. Do not pay.

Prepare before it happens. A tested plan and a protection layer in place cost far less than a day of lost sales.