What is DDoS protection?
By Ash, Founder, HosteazePublished 2 min read
The short answer
DDoS protection is a set of defences that keep your website online when someone floods it with traffic from many computers at once, a distributed denial of service attack. It works by spotting the junk traffic and filtering it out upstream, before it reaches your server, while letting real visitors through.
Picture your website as a small shop with one door. A denial of service attack fills the doorway with thousands of people who have no intention of buying anything, so real customers can't get in. When that crowd comes from many different computers at once, often hijacked devices, it's a distributed denial of service attack, or DDoS. DDoS protection is the system that spots the crowd and clears it.
How does a DDoS attack work?
The UK's National Cyber Security Centre (NCSC) describes a denial of service attack as an attempt to overload a website or network so it slows down or becomes inaccessible. The distributed kind comes from many sources, which makes it more powerful and harder to tell apart from genuine visitors.
Attacks come in two broad flavours. Volume attacks try to fill your connection with sheer quantity of traffic. Application attacks are subtler: a smaller number of requests aimed at something expensive, like a search page that hits your database each time.
What does DDoS protection actually do?
| Layer | What it does | Who usually provides it |
|---|---|---|
| Network filtering ("scrubbing") | Drops traffic that matches attack patterns before it reaches the server | Your host's network or its upstream provider |
| Content delivery network (CDN) | Spreads traffic across many locations and absorbs spikes | A CDN service in front of your site |
| Rate limiting | Caps how many requests one source can make in a set time | The host, a CDN or a WAF |
| Web application firewall | Blocks malicious requests based on what they contain | The host, a CDN or a plugin |
The NCSC's advice is blunt: a determined attacker can nearly always send more traffic than an organisation can cope with alone. That's why protection works best upstream, at the host or network level, rather than on your own website. A CDN and a web application firewall add useful extra layers.
What should a small business do about DDoS?
- Ask your host what DDoS mitigation is included and what happens to your site if it's attacked.
- Check whether your host might take a targeted site offline to protect other customers, and for how long.
- Consider putting a CDN in front of your site, especially if you sell online.
- Keep your DNS with a provider that can handle large volumes of queries.
- Write down who to call and what to tell customers if the site goes down, before you need it.
The fifth step costs nothing and saves real panic. Our guide on how to protect a website from hackers covers the other security basics.
Frequently asked questions
Why would anyone attack a small business website?
Usually not personally. Some attacks are extortion attempts, some are aimed at a neighbour on the same network, and some are simply cheap to launch. Small sites are more often caught up in attacks than singled out.
Will a DDoS attack steal my data?
Not by itself. A DDoS attack is about availability, knocking you offline. The NCSC notes the damage can be serious even when data isn't touched, through lost sales and staff unable to work. Occasionally attackers use one as a distraction, so check your logs afterwards.
How do I know if my site is under a DDoS attack?
Typical signs are a sudden, sustained traffic spike with no obvious cause, the site slowing to a crawl or timing out, and server errors such as 503. A viral post can look similar, so check your analytics before assuming the worst.