What Is Cloudflare and Why Use It for Your Website?
What Cloudflare does for your website: CDN caching, DNS, free SSL, firewall and DDoS protection, bot control and performance features, plus setup step…
DDoS Attacks Explained: How They Work and Effective Ways to Protect Your Website
A distributed denial-of-service (DDoS) attack tries to make a website unavailable by overwhelming it with traffic from many sources at once. For an online store or booking site, even an hour offline means lost sales and frustrated customers. Understanding how these attacks work makes it much easier to prepare.
Key takeaways
- DDoS attacks flood a site or server until real visitors can't get through.
- Most small and mid-size sites are best protected by a CDN with DDoS mitigation in front of the server.
- Rate limiting, caching and a firewall reduce the impact of application-layer attacks.
- Prepare a response plan with your host before an attack happens.
Types of DDoS attacks
| Type | Target | Example |
|---|---|---|
| Volumetric | Network bandwidth | UDP floods, amplification attacks |
| Protocol | Server and network resources | SYN floods |
| Application layer (Layer 7) | The website or API itself | Floods of HTTP requests to search or login pages |
Application-layer attacks are harder to spot because each request looks like a normal visit.
Warning signs
- Sudden, unexplained traffic spikes from many IPs or countries.
- The site becomes slow or returns errors while server resources max out.
- Unusual requests to the same URL, such as search or login.
- Your host notifies you about abnormal traffic.
Protection measures
- Use a CDN with DDoS mitigation such as Cloudflare to absorb and filter traffic before it reaches your server.
- Web application firewall: block malicious patterns and known bad bots.
- Rate limiting: cap requests per IP to login, search and API endpoints.
- Caching: serve as much as possible from cache so the server does less work.
- Hide the origin IP: only allow traffic from your CDN to reach the server.
- Scalable hosting: cloud or managed hosting that can absorb spikes.
- Monitoring and alerts: know quickly when something unusual starts.
See what Cloudflare does for your website.
During an attack
- Confirm it's an attack and not a legitimate traffic spike from a campaign.
- Enable stricter protection modes in your CDN (for example, an "under attack" mode).
- Add temporary rules to block or challenge offending countries, IP ranges or patterns.
- Contact your hosting provider for network-level help.
- Keep customers informed if the outage is visible.
- Review logs afterwards and strengthen permanent rules.
Business continuity
Keep backups, a status page or social channel for updates, and a list of contacts at your host and CDN. For critical stores, consider uptime SLAs and multi-region hosting.
DDoS readiness checklist
- CDN with DDoS protection in front of the website.
- Origin server accepts traffic only from the CDN.
- Rate limits on login, search and API endpoints.
- Caching for as many pages as possible.
- Monitoring and alerting configured.
- Contact details for host and CDN support ready.
- A status page or social channel for customer updates.
Example: protecting a store during a sales campaign
Before White Friday, an online store enabled CDN caching for product and category pages, added rate limits to search and checkout endpoints, scaled its cloud server and set alerts for traffic anomalies. When a bot flood hit search, rules challenged the traffic while real customers continued shopping.
Common mistakes to avoid
- Exposing the origin server IP even after adding a CDN.
- Having no contact plan with the host during an incident.
- Leaving search and login endpoints without rate limits.
- Blocking whole countries permanently and losing real customers.
Protecting APIs and mobile app backends
Mobile apps often call APIs directly, making them targets for floods. Use API gateways or CDN rules with rate limits per token or IP, require authentication, cache public endpoints and monitor unusual traffic patterns. Separate admin APIs from public ones.
Logging and post-incident review
After an attack, review logs to identify patterns (paths, user agents, countries), keep the rules that worked, document response times and update your runbook. Share lessons with your host and development team.
Questions to ask your host
- What network-level DDoS protection is included?
- How do you notify customers about attacks?
- Can you null-route or filter traffic quickly?
- What are the costs if traffic spikes?
Frequently asked questions
Can a small website be targeted by DDoS?
Yes. Attacks can be cheap to launch and are sometimes used against competitors or for extortion.
Is DDoS the same as hacking?
Not exactly. DDoS aims to make a site unavailable; it doesn't necessarily involve breaking in, though attackers sometimes use it as a distraction.
Does shared hosting protect against DDoS?
Hosts provide some network protection, but a CDN with dedicated mitigation offers much stronger defence for your specific site.
How long do DDoS attacks last?
From minutes to days. Good mitigation reduces the impact so real visitors can keep using the site.
Can I tell a DDoS from a viral spike?
Real visitors browse varied pages and convert; attack traffic is repetitive, often from unusual sources and doesn't behave like customers.
Do I need paid DDoS protection?
Many small and mid-size sites are well protected by a CDN's standard plan; high-risk or high-revenue sites may need advanced paid protection and SLAs.
