Guide
What is a DDoS attack, and how does it affect your website?
A DDoS (distributed denial of service) attack floods a website or server with so much junk traffic that real visitors cannot get through. The traffic comes from thousands of hijacked devices at once, so blocking one address does not help. Good hosting filters the flood before it reaches your site. Every plan with us includes DDoS protection on UK servers.
The picture
How a DDoS attack works
- AttackerControls a network of hijacked devices
- BotnetThousands of computers, cameras and routers
- FloodAll send requests at the same moment
- FilterProtection drops the bad traffic
- Your siteReal visitors still get through
Without a filter, the flood reaches the server and the site slows down or goes offline.
The basics
What the name actually means
Denial of service means making a service unavailable to the people who should be able to use it. The attacker is not trying to break in or steal anything. The aim is simply to knock the website over, or to make it so slow that nobody can use it. The word distributed means the attack comes from many places at once rather than from a single computer.
That distribution is what makes the attack hard to stop with simple tools. If one computer sends a million requests, you can block that one address. If a hundred thousand computers each send ten requests, every individual address looks almost normal, yet together they overwhelm the server. The machines involved are usually ordinary devices that have been infected with malware without their owners knowing, collectively called a botnet.
Think of a shop with one door. A DDoS attack is like thousands of people crowding into the doorway at once with no intention of buying anything. Genuine customers cannot get in, and the shopkeeper cannot tell who is who without checking each person.
Types
The three main kinds of DDoS attack
Volumetric
The attacker tries to fill the pipe with raw traffic, so that legitimate requests cannot squeeze through. Measured by the amount of data.
Protocol
These abuse how network connections are set up, tying up servers and firewalls with half-finished connections. Measured by packets.
Application layer
Many requests that look like real visitors, such as thousands of searches or logins, aimed at the most expensive pages. Measured by requests.
DDoS protection is included
Every plan runs on UK servers in London with DDoS protection and a ModSecurity firewall.
Why it happens
Why would anyone attack a small website?
Small business sites are rarely the intended target of a large, planned campaign, but they do get hit. Motives vary. Some attackers demand a payment to stop, which is extortion. Some are settling a grievance against a person or company. Some are competitors, or people showing off a tool. Sometimes a site is simply collateral damage because it shares a server or network with the real target.
Another common cause is not malicious at all. A page that suddenly goes viral, a mention on television or a big email campaign can produce a surge of genuine visitors that looks and feels like an attack. The cure for that is different, usually caching and a plan with enough resources, so it is worth knowing which problem you have.
Because attacks are cheap to buy and easy to launch, the sensible assumption is that any site can be hit at some point. The question is not whether you are interesting enough but whether your hosting is prepared.
Spotting it
Attack or just a busy day?
| Sign | Points to an attack | Points to genuine traffic |
|---|---|---|
| Traffic source | Huge numbers of requests from unrelated, often foreign, addresses | Visitors from places your customers live |
| Pages requested | Same page or search over and over | A spread of pages and normal browsing |
| Timing | Sudden spike with no trigger, then drops | Follows an email, advert or news mention |
| Behaviour | No purchases, no form completions | Orders and enquiries rise too |
| Visitor devices | Odd or missing browser details | Normal mix of phones and computers |
| Effect | Site slow or down for everyone | Slow only at peak, recovers quickly |
Check your hosting statistics and any analytics together. One signal alone can mislead.
Defence
How hosting protects you from DDoS
Protection works in layers. At the network edge, traffic is inspected and obviously hostile floods are dropped before they ever reach your server. At the server, a firewall such as ModSecurity blocks requests that match known attack patterns, and rate limits slow anything that hammers one page. On a shared server, isolation means that an attack on one account does not drain resources from every other account.
On our hosting, DDoS protection, the ModSecurity firewall, Imunify360 and CloudLinux isolation are included on every plan, running from London. The fast LiteSpeed web server and caching also help, because a cached page costs far less to serve than one built from scratch, so the server can absorb more junk requests before struggling.
No provider can promise that nothing will ever get through, and very large attacks can cause disruption anywhere. What protection does is make the common, everyday attacks irrelevant to you, and give you a team to talk to when something larger happens. You can read more on our web hosting security page.
What helps
Server protection and what you do yourself
Handled by the host
- Network filtering of floods
- A web application firewall
- Rate limiting and connection limits
- Isolation between accounts
- Monitoring and malware scanning
Handled by you
- Keep software and plugins updated
- Use caching so pages are cheap to serve
- Protect login pages with limits and two-factor
- Keep a tested backup
- Know who to contact in a hurry
If it happens
What to do if your site is under attack
Confirm it is real
Check whether the site is down for everyone, and look at traffic statistics for a sudden strange spike.
Contact support straight away
Use live chat (open 24/7) or a ticket, and say when it started and what you see. We can look at server logs.
Do not pay anyone
If you get a message demanding money to stop an attack, do not pay. Keep it, and report it.
Tighten what you can
Turn on caching, disable heavy plugins temporarily and protect the login page.
Keep a record
Note times, symptoms and messages. It helps both support and any report to the police.
Review afterwards
Once it passes, update everything and check that no malware was planted during the confusion.
Law
Reporting and the legal side in the UK
Launching a DDoS attack is a criminal offence in the UK. This is general guidance and not legal advice. If you are blackmailed or your business suffers serious harm, report it through Action Fraud, and the National Cyber Security Centre publishes practical guidance on denial of service attacks that is free to read.
If an attack was combined with a break-in that exposed personal data, data protection rules may require you to tell the Information Commissioner's Office. A pure traffic flood normally does not expose data, but an attacker sometimes uses the distraction to cover something else, which is one more reason to check carefully afterwards.
Be ready
A short DDoS readiness checklist
- Hosting with DDoS protection included
- Caching switched on for public pages
- Software, themes and plugins up to date
- Login pages protected with limits
- Two-factor on admin accounts
- A recent backup stored away from the server
- Support contact details saved somewhere you can reach
- Someone named who decides what to do
FAQ
Common questions
What does DDoS stand for?
Distributed denial of service. Many devices attack a single target at once to make it unavailable.
Can DDoS attacks steal my data?
A flood on its own does not steal data. It aims to disrupt. However, attackers sometimes use it as cover, so check afterwards for other problems.
Does my hosting include DDoS protection?
Yes. DDoS protection is included on every plan, together with a ModSecurity firewall and Imunify360.
How long does a DDoS attack last?
It varies from minutes to days. Many are short bursts, and protection at the network edge usually reduces the impact quickly.
Is a traffic spike always an attack?
No. Viral posts, emails and adverts can cause genuine surges. Check where the traffic comes from and whether it behaves like real visitors.
Keep reading
Related pages
Host on servers built to absorb attacks
DDoS protection, a firewall and 24/7 live chat on every plan.