A DDoS (distributed denial-of-service) attack tries to knock a website or online service offline by overwhelming it. Thousands or millions of devices send traffic at the same moment, so the server, its network link or the software on it runs out of capacity and genuine customers get errors or endless loading.
Where the attacking traffic comes from
Most attacks use a botnet: a large group of computers, routers, cameras and other devices infected with malware and controlled remotely. The owners usually have no idea. The Mirai botnet in 2016 built itself from poorly secured internet-connected cameras and routers, and its attack on the DNS provider Dyn made sites such as Twitter, Netflix and Reddit unreachable for many users that day. Attackers can also rent botnet capacity through so-called "booter" services.
Three kinds of flood
- Volumetric: sheer data, measured in gigabits or terabits per second, to fill the pipe. Amplification tricks bounce small requests off open DNS or NTP servers to produce much larger replies aimed at the victim.
- Protocol: abuse of how connections are set up, such as SYN floods that leave a server holding half-open connections.
- Application layer: realistic-looking HTTP requests to expensive pages like search or checkout. Each request is small, but the server work behind it is not.
A DDoS is different from a breach: nothing is stolen, the goal is downtime. It is sometimes used as a smokescreen or paired with a ransom demand.
Is a small-business site a target?
Rarely as a deliberate choice, but small sites get caught up in attacks on shared hosting neighbours, and online shops in competitive niches do see extortion attempts. The real question is where your site lives. Sites served through a large CDN or platform (Cloudflare, Vercel, Netlify, Shopify and similar) sit behind networks built to absorb large floods. A single self-managed VPS with no front protection can go down from a modest attack.
A typical response
A ticket-selling site goes down every evening during a sale. Logs show a burst of requests to the search page from thousands of addresses. Moving the domain behind a CDN, caching pages that do not change, adding a rate limit on search and a bot challenge brings it back without touching the application code.
DDoS mistakes
- Exposing the origin IP in old DNS records or emails, so attackers skip the protection layer.
- No plan for who to call when the site goes down during a launch.
- Scaling servers up to soak the attack on a pay-per-use plan and receiving a huge bill.
- Treating every traffic spike as an attack and blocking real customers after a mention in the press.
Related terms
- Firewall: filters and rate-limits hostile requests.
- CDN: spreads load across a global network.
- Load balancer: shares traffic across several servers.
- Bandwidth: what volumetric floods try to exhaust.