What Is a DDoS Attack and How Do You Defend Against It?

Your website is suddenly crawling. Then it stops loading at all. Orders stop, the support line lights up and your hosting provider says traffic is through the roof, but none of it is from real customers. That is what a distributed denial-of-service (DDoS) attack feels like from the inside.

DDoS attacks used to be something only banks and big retailers worried about. Not anymore. Attack tools are cheap to rent, and small business sites, online stores, schools and local governments all get hit. The good news is that the defenses have become cheaper too, and many sites already have more protection than they realize.

This guide explains what a DDoS attack is, the main types, who gets targeted and the protection options that make sense for small and mid-size sites.

What a DDoS attack is

A denial-of-service (DoS) attack tries to make a website, server or network unavailable to the people who are supposed to use it. A distributed denial-of-service attack does this using traffic from many machines at once, usually a botnet of infected computers, routers, cameras and other internet-connected devices.

Because the traffic comes from thousands of different addresses, you can’t just block one IP. And because it often looks like normal requests, it can be hard to tell attack traffic from a sudden rush of real customers.

DDoS attacks don’t usually steal data. Their goal is downtime. But they can be used as a distraction while attackers try something else, or paired with a ransom demand, which makes them part of a wider security problem.

The 3 main types of DDoS attacks

The joint guide from CISA, the FBI and MS-ISAC, Understanding and Responding to Distributed Denial-of-Service Attacks (updated in March 2024), groups attacks into 3 categories.

Volumetric attacks

These try to use up all your bandwidth by sending more data than your connection can handle. Common examples include UDP floods and reflection or amplification attacks, where attackers send small requests to open servers on the internet that reply with much larger responses aimed at your address.

Protocol attacks

These target weaknesses in how network protocols work, exhausting the capacity of servers, firewalls or load balancers. A SYN flood, which opens huge numbers of half-finished connections, is the classic example.

Application-layer attacks

These target the website or app itself, often with requests that look legitimate, such as repeatedly loading a search page, login form or checkout. They need far less traffic to cause damage because each request makes your server do real work. They are also the hardest to spot.

Who gets targeted and why

Motives vary. Common ones include:

• Extortion: “Pay us or your site stays down.” These ransom demands sometimes come before any real attack.
• Competition or grudges: A rival, a fired employee or an angry customer renting an attack.
• Activism: Groups targeting organizations over politics or public statements.
• Distraction: Keeping your team busy while attackers try to break in elsewhere.
• Gaming and online communities: Players and servers hit to gain an edge or settle scores.

Renting an attack is easy because “booter” or “stresser” services sell them online. The FBI states that using these services to attack a site is a federal crime under the Computer Fraud and Abuse Act, and law enforcement agencies have seized many such sites through an international effort called Operation PowerOFF. That hasn’t stopped new ones from appearing.

Key takeaway: You can’t stop someone from launching a DDoS attack, but you can make sure the traffic hits a provider built to absorb it instead of your own server. For most small and mid-size sites, that one decision does most of the work.

Signs you may be under a DDoS attack

Not every traffic spike is an attack. A product launch or viral post can look similar. Warning signs include:

• The site or app becomes slow or unreachable for everyone, not just some users
• A sudden traffic surge from unusual countries, networks or user agents
• Huge numbers of requests to a single page, often search, login or checkout
• Server CPU, memory or bandwidth maxed out with no matching rise in sales or sign-ups
• Your host or ISP warning you about abnormal traffic
• An email demanding payment to stop the attack

DDoS protection options for small and mid-size sites

You don’t need a dedicated security team to be reasonably protected. These are the main options, from easiest to most involved.

1. A CDN or reverse proxy with built-in DDoS protection. A content delivery network sits between visitors and your server, spreading traffic across a large global network. Many CDNs include DDoS mitigation. For example, Cloudflare’s documentation says it provides unmetered DDoS protection at layers 3, 4 and 7 on all plans, including its free plan. Other providers, such as Akamai, Fastly and the major cloud platforms, offer similar services at different price points.

2. Your cloud or hosting provider’s built-in protection. Major clouds include a baseline layer. AWS Shield Standard, for instance, is applied automatically to AWS customers at no additional charge and covers common network and transport layer attacks. Managed hosts and website builders often include protection too. Ask your provider exactly what is covered.

3. A web application firewall (WAF). A WAF filters malicious requests at the application layer. Pair it with rate limiting on login, search and checkout pages. If you are new to the concept, start with what a firewall is, then look at the WAF options your CDN or cloud already offers.

4. Premium DDoS protection services. Larger or higher-risk organizations can buy advanced tiers with 24/7 response teams, cost protection and custom rules. These cost far more. AWS lists Shield Advanced at $3,000 per month per organization with a 1-year commitment, plus usage fees, as one example. Pricing varies widely across vendors.

5. ISP-level mitigation. If you run your own network or on-premises servers, ask your internet provider whether it offers upstream DDoS scrubbing.

Build resilience before an attack

Protection services work best on a site that is already built to handle stress:

• Cache what you can. Static pages and images served from a CDN never touch your server.
• Hide your origin server. Make sure the server’s real IP address isn’t exposed in DNS records or old subdomains, so attackers can’t bypass your protection.
• Add redundancy. Multiple servers and regions reduce single points of failure. Our guide on high availability explains how.
• Set up monitoring and alerts for traffic, error rates and server load.
• Know your contacts. Keep the support numbers for your host, CDN and ISP somewhere you can reach when the site is down.

What to do during an attack: a step-by-step plan

1. Confirm it’s an attack. Check traffic patterns and talk to your host or CDN to rule out a legitimate spike or a technical failure.
2. Contact your providers. Your CDN, host or ISP can often apply stronger filtering faster than you can.
3. Turn on stricter modes. Many CDNs offer an “under attack” or challenge mode that tests visitors before letting them through.
4. Rate-limit and block patterns. Limit requests to targeted pages and block clearly malicious sources, countries or user agents if they aren’t your customers.
5. Communicate. Post a short status update on social media or a status page so customers know you’re aware.
6. Don’t pay a ransom. Payment doesn’t guarantee the attack stops and marks you as a willing target.
7. Report it. The FBI asks DDoS victims to report to IC3 or a local field office regardless of the loss amount.
8. Review afterward. Note what worked and update your incident response plan.

Where to start this week

If you do nothing else, do these 4 things:

1. Find out whether your site is already behind a CDN or protection service, and what your plan includes.
2. If it isn’t, put it behind one. Many providers offer free or low-cost tiers for small sites.
3. Turn on WAF rules and rate limiting for login and checkout pages.
4. Write down your host, CDN and ISP emergency contacts and add them to your incident plan.

For broader hardening, see our cloud security checklist and cybersecurity checklist for small business.

Conclusion

A DDoS attack is about one thing: making you unavailable. You can’t control whether someone points a botnet at your site, but you can control where that traffic lands. Put a protection service in front of your site, harden your login and checkout pages, keep your origin hidden and know who to call. For most small and mid-size businesses, that setup turns a potential day-long outage into a blip.

Sources

• CISA, FBI and MS-ISAC: Understanding and Responding to Distributed Denial-of-Service Attacks — attack categories, preparation and response steps (updated March 2024)
• Cloudflare DDoS Protection documentation — unmetered layer 3, 4 and 7 DDoS protection on all plans
• AWS Shield pricing — Shield Standard included at no extra charge; Shield Advanced pricing and commitment
• FBI: Efforts to Combat Illegal DDoS Attacks — booter and stresser services illegal under the Computer Fraud and Abuse Act; reporting guidance