DDoS Attacks and Protection: The Basics for Site Owners

Imagine your shop has one door, and someone sends 10,000 people to stand in line with no intention of buying anything. Real customers can''t get in. That is essentially a DDoS attack — Distributed Denial of Service. An attacker uses thousands of infected computers and devices (a botnet) to flood your site with fake requests until the server stops responding.

Why would anyone attack your site?

Small businesses often ask: "Who would bother attacking a local salon''s website?" The answers are more mundane than you''d think: unfair competition (DDoS attacks rent on the black market for as little as $10–20 per hour), extortion ("pay up or stay offline"), or plain collateral damage — another site on the same server was the target, and yours went down with it. Cloudflare''s reports show double-digit annual growth in DDoS attacks, and most targets are small and medium sites, precisely because they are the least protected.

The three main attack types

• Volumetric attacks — raw traffic volume (hundreds of Gbps) that saturates the network link. The most common type, but also the easiest to filter at the network level.
• Protocol attacks (e.g. SYN flood) — exhaust server and network equipment resources with half-open connections.
• Application-layer (L7) attacks — the sneakiest: they look like legitimate users browsing pages, searching, adding to cart. Low volume, high damage, hard to tell apart from real traffic.

What an attack looks like from your side

Pages take ten seconds to load or don''t load at all, your hosting panel shows CPU and RAM spiking, the logs show thousands of requests from hundreds of different IPs hitting the same URL, and Google Analytics shows no traffic increase — because bots usually don''t execute JavaScript. If you see this combination, don''t try to block IPs one by one; against a distributed attack that''s a losing game.

What you can realistically do

• Use a CDN. A CDN spreads traffic across a global server network, so a volumetric attack hits infrastructure with multi-terabit capacity instead of your single server. This is the first and most effective line of defense.
• Enable a WAF (Web Application Firewall) — it filters suspicious requests before they reach your site and is essential against L7 attacks.
• Rate limiting — cap the number of requests per IP per minute, especially on login and search endpoints.
• Cache aggressively. A cached page is served without touching the database — a site that answers 95% of requests from cache withstands many times more pressure.
• Choose hosting with protection built in. All our plans — starting with SEO Start at €4.20/month — include DDoS protection, a WAF, and a free global CDN, so most attacks are filtered before you even notice them.

A plan for when it happens

If an attack does get through: contact your hosting support immediately (tell them when it started and what you''re seeing), switch on "Under Attack" mode if your CDN offers one, and never pay extortion demands — paying just marks you as a target that pays. The good news: with a CDN + WAF combination, the vast majority of attacks on small sites end up as a few lines in a log file, not downtime. For more on how fast, protected hosting affects your rankings, see our guide to SEO hosting.