In this article · 6 sections
A DDoS attack (distributed denial of service) floods a website or server with traffic from many machines until it slows down or goes offline. Big companies face huge attacks, but small businesses get hit too, sometimes by competitors during peak season, or simply as collateral on shared hosting.
Types of DDoS
- Volume attacks: massive traffic that clogs the network
- Protocol attacks: abusing how connections work to exhaust server resources
- Application (Layer 7) attacks: many requests to heavy pages like search, login or booking forms; these can take down small sites with relatively little traffic
Is it really a DDoS?
Many "attacks" are actually:
- A genuine traffic spike (a viral post, a festival rush)
- A badly behaving bot or crawler
- Slow database queries or hosting limits. See reduce server response time
Signs of an attack: huge numbers of requests from many IPs, the same URL hit thousands of times, odd user agents, traffic from countries you don't serve.
Protection for small sites
- Put the site behind a CDN/WAF like Cloudflare, which absorbs large attacks and offers an "Under Attack" mode. See WAF explained
- Rate-limit expensive endpoints (login, search, forms, APIs)
- Cache pages so the server does less work per visit
- Hide your origin server IP (don't expose it in DNS records or emails sent from the server)
- Choose hosting with network-level DDoS protection
- CAPTCHA or bot checks on forms
During an attack
- Turn on your CDN's attack mode
- Block obvious bad countries/IP ranges temporarily
- Contact your host; they may filter traffic upstream
- Keep customers informed via WhatsApp and social media, with your phone number for bookings
- Note times and screenshots for reporting to CERT-In if needed. See CERT-In guidelines
After
Review logs, keep the rules that helped, and make sure your booking phone and WhatsApp are always visible as a fallback.
FAQs
Can a DDoS steal data?
Not by itself; it disrupts availability. Sometimes it's used as a distraction, so check logs for other activity.
Is DDoS protection expensive?
Basic protection through a CDN is free or low-cost for small sites.
Was this article helpful?
Your answer helps us improve our guides