In December 2025, Cloudflare detected and mitigated a 31.4 Tbps DDoS attack that lasted just 35 seconds, the largest publicly disclosed attack at the time. But attacks do not need to reach that scale to cause downtime.
A DDoS attack can overwhelm a website with more traffic or requests than its network, server, or application can handle, leaving genuine visitors with slow pages, errors, or timeouts.
So, how does a DDoS attack work, and what can you do to protect your website? This guide explains it simply and covers practical ways to prevent DDoS attacks and protect online stores.
What Is a DDoS Attack and How Does It Work?
A DDoS attack does not necessarily mean someone has broken into your website. In many cases, the goal is simply to make the website unavailable by exhausting its network, server, or application resources.
A Distributed Denial-of-Service (DDoS) attack works in much the same way. An attacker sends a large amount of unwanted traffic or requests toward a website, server, network, or application. When the infrastructure cannot handle the sudden load, the website may become slow, return errors, or stop responding to legitimate visitors.
The word distributed is important. A normal DoS attack may come from a single source, while a DDoS attack usually comes from many compromised devices working together. This can include computers, routers, IoT devices, and other internet-connected systems controlled remotely by an attacker.
How Does a DDoS Attack Happen?
The process is easier to understand than it sounds:
1. The attacker controls a network of compromised devices
The attacker gains control of many internet-connected devices, often by infecting them with malware.
2. The compromised devices receive instructions
The attacker directs these devices to send traffic or requests toward a chosen target.
3. The website receives a flood of traffic
Thousands or more devices can send requests at the same time, creating a traffic surge that is far beyond normal visitor activity.
4. The target becomes overwhelmed
The traffic consumes available bandwidth or server, network, or application resources. As a result, genuine visitors may experience slow loading, errors, or complete downtime.
The difficult part is that not every DDoS request looks obviously malicious. Some application-layer attacks can resemble ordinary website requests, making it harder to separate attackers from genuine visitors.
In simple terms: a DDoS attack tries to make your website too busy serving fake traffic to properly serve real visitors.
How Do I Know If My Website Is Under a DDoS Attack?
A DDoS attack can make a website slow, unreliable, or completely unavailable. The first signs are usually easy to notice: pages take longer to load, requests start failing, and server resources suddenly climb.
Look for these warning signs:
- Traffic suddenly jumps: Requests or bandwidth are much higher than usual.
- Pages become slow: Your website takes longer to load even though you haven’t changed anything.
- Server resources spike: CPU, memory, bandwidth, or active connections suddenly increase.
- One part of the website gets hammered: A login page, search function, API, or another endpoint may receive an unusual number of requests.
- Visitors report timeouts: Multiple users may suddenly have trouble accessing the website.
- Your server reaches its limits: Connections or network capacity can become exhausted, causing requests to fail.
A traffic spike alone does not mean you are under attack. A successful marketing campaign, viral post, or sudden increase in genuine visitors can cause the same thing. Check your traffic patterns, server resources, and logs together before treating the spike as a DDoS attack.
How Do Hackers Launch a DDoS Attack?
The difficult part of a DDoS attack is not simply sending a lot of traffic. It is sending traffic from enough different sources that the target cannot easily separate malicious requests from genuine visitors.
Attackers commonly use compromised devices to create this distributed traffic. Because those requests can come from different IP addresses, networks, locations, and devices, blocking one source rarely stops the attack.
Why Is It Difficult to Block the Attacker?
Blocking one IP address is rarely enough because a DDoS attack can involve many sources at the same time. Effective protection needs to examine traffic patterns and behaviour rather than relying only on individual IP addresses.
What Are the Different Types of DDoS Attacks?
Not every DDoS attack works in the same way. Some attacks try to fill up your network with traffic, while others target the way your server or website handles connections and requests.
You do not need to understand every technical detail to understand the three main types:
| Type | What It Targets | How It Works |
|---|---|---|
| Volumetric Attacks | Network bandwidth | Sends a very large amount of traffic toward the target and attempts to consume its available bandwidth. |
| Protocol Attacks | Network & server resources | Sends large numbers of connection or protocol requests that consume resources needed to handle normal connections. |
| Application-Layer Attacks | Website or application | Sends a high number of requests to pages, APIs, searches, or other application features to overload them. |
Volumetric attacks
These attacks are mainly about traffic volume. The attacker sends so much data toward the target that the available network capacity can become overwhelmed. UDP floods are one common example.
Protocol attacks
These attacks focus more on how network connections are handled. A SYN flood, for example, sends a large number of connection requests and can consume server resources as the system tries to process them.
Application-layer attacks
These attacks target the website itself. An HTTP flood may send a large number of web requests that look similar to requests from normal visitors. If enough requests reach a resource-heavy page or API, the application can struggle to respond to genuine users.
The main difference is what the attacker is trying to exhaust: network bandwidth, connection resources, or the website’s own application resources. In practice, a DDoS attack can also combine different techniques, which is why relying on just one protection method is rarely enough.
How to Prevent a DDoS Attack
You cannot guarantee that your website will never face a DDoS attack. What you can do is put protection between your website and the incoming traffic so malicious requests are filtered before they overwhelm your server.
If your website supports your business, adding DDoS protection is worth considering. Choosing a hosting provider that already includes protection can also be simpler than building and managing every security layer yourself.
1. Put Your Website Behind a CDN
A CDN sits between your visitors and your server:
Visitor – CDN – Your Server
A CDN can serve cached content without sending every request to your origin server. It should also be part of a broader security strategy that includes the right website security tools.
If you use a CDN, make sure your origin server is not left openly accessible. Otherwise, attackers may simply bypass the CDN and target the server directly.
2. Choose Hosting With DDoS Protection
When a DDoS attack fills your server’s network connection, a firewall running on the server cannot recover the bandwidth already being consumed. The traffic needs to be handled before it puts that much pressure on your hosting environment.
This is why choosing hosting with built-in DDoS protection can be useful. BigCloudy provides DDoS protection on supported hosting plans, adding an extra security layer without requiring you to build the entire protection setup yourself.
How Does BigCloudy Help With DDoS Protection?
BigCloudy’s DDoS protection is part of its wider hosting security setup. Depending on the hosting plan, it works alongside other security controls to help protect your website from unwanted traffic and reduce the impact of traffic floods.
The exact protection and security features vary by hosting product, so check the plan details when choosing a solution for a website where availability matters.
If you’re moving your website to BigCloudy, choosing a plan with DDoS protection gives you an additional layer of security without having to manage every part of the setup yourself.
3. Use a Web Application Firewall
A Web Application Firewall (WAF) checks web requests before they reach your application. It can use security rules to identify and block unwanted or suspicious HTTP traffic.
A WAF is particularly useful for protecting application-level targets such as login pages, forms, APIs, and other frequently requested parts of your website.
4. Set Request Limits
Not every visitor needs to make hundreds of requests within a few seconds. Rate limiting lets you control how many requests a client can make during a set period.
It is especially useful for:
- Login and account pages
- Search
- APIs
- Contact forms
- Checkout
- Other resource-heavy endpoints
Don’t copy a random rate limit from another website. Check your normal traffic first and set limits that allow genuine users to use the site while slowing down abnormal request bursts.
5. Keep Your Origin IP Protected
If attackers find your server’s real IP address, they may try to connect to it directly and bypass your CDN or WAF. Where your setup allows it, configure the origin to accept traffic only from your trusted protection layer. Also check DNS records and other services for accidental exposure of the origin IP.
6. Keep Your Firewall Tight
Your server firewall still matters, but it should be one layer of protection, not the entire DDoS strategy. Close ports you do not need, allow only required services, restrict administrative access, and review your firewall rules regularly. This reduces the number of ways attackers can interact with your server.
7. Watch Your Normal Traffic
You cannot spot unusual traffic if you don’t know what normal traffic looks like.
Monitor this:
- Request volume
- Bandwidth usage
- CPU and memory
- Active connections
- Frequently requested URLs
- Sudden traffic from unusual sources
A sudden spike does not automatically mean a DDoS attack. It could simply be a successful campaign or a page going viral. Looking at the traffic pattern and server behaviour together gives you a much clearer picture.
The simplest approach is layered protection: CDN + DDoS mitigation + WAF + rate limiting + a properly configured firewall + traffic monitoring. Each layer handles a different part of the problem, making it much harder for unwanted traffic to reach and overwhelm your website.
How to Set Up DDoS Protection for My Online Store?
For an online store, DDoS protection is about more than keeping the homepage online. It should be part of a broader eCommerce security strategy that covers customer data, application security, WAF protection, and regular security updates. A sudden flood of requests can also put pressure on login pages, product searches, APIs, cart functions, and other parts of the store.
A practical setup should protect the storefront, important endpoints, and the customers using them.
Protect the storefront first
Start with the basics: put your store behind a CDN and DDoS protection layer, then add a WAF to inspect suspicious web requests. This allows much of the unwanted traffic to be filtered before it reaches your hosting server. A modern ecommerce security setup can combine DDoS protection, application security, and bot controls. These measures should work alongside strong eCommerce website performance practices to keep your store fast and available during traffic spikes.
Pay extra attention to important pages
Not every page on an online store puts the same amount of work on your server. Give extra attention to areas such as:
- Login and account pages
- Product search and filters
- Cart and checkout
- APIs
- Product or price lookup requests
Rate limiting can help control excessive requests to these endpoints and reduce the risk of a single client or automated system consuming too many resources.
Don’t block your genuine customers
Security rules should not be so aggressive that they start blocking real shoppers.
For example, setting a very low request limit on a product search page could stop a genuine customer who is simply comparing several products. It’s better to study your normal traffic, identify unusual request patterns, and then create rules around those patterns. Cloudflare also recommends validating rate limits before moving from logging to blocking or challenging traffic.
The goal is simple: stop traffic that appears abusive without forcing genuine customers to fight their way through your security.
For store owners who don’t want to manage every protection layer themselves, choosing hosting with DDoS protection already included can make the setup much easier.
How Do Cloud-Based DDoS Mitigation Services Work?
Cloud-based DDoS protection works by filtering traffic before it reaches your website’s server. Instead of having your VPS or hosting server handle the entire attack, the protection network processes the incoming traffic first, filters out malicious requests, and allows legitimate traffic to continue to your website.
The basic flow looks like this:
Visitor traffic > DDoS protection network > Traffic inspection > Malicious traffic filtered > Genuine traffic > Your server
1. Traffic is routed through the protection network
Your website’s traffic first passes through the provider’s DDoS protection network. This gives the protection system a chance to inspect incoming traffic before it reaches your origin server.
2. Unusual traffic is identified
The system looks for patterns that do not match normal visitor behaviour, such as sudden traffic bursts, abnormal request rates, or other signs of an attack.
3. Malicious traffic is filtered
Traffic identified as malicious can be blocked, dropped, or challenged before it reaches your server. This reduces the amount of unwanted traffic your infrastructure has to handle.
4. Genuine visitors reach your website
Once the malicious traffic has been filtered, legitimate requests can continue to your website as normal. The biggest advantage is scale. Cloud-based DDoS providers operate large networks designed to handle much more traffic than a typical website server can handle on its own. This means an attack can be absorbed and filtered outside your hosting environment, rather than allowing the traffic to overwhelm your server.
What Should I Do If a DDoS Attack Is Already Happening?
If your website is already being flooded with traffic, don’t start changing random settings. First, confirm what is happening and then move the traffic through your protection layers.
1. Check the traffic spike
Look at your traffic analytics, bandwidth, active connections, server resources, and request patterns. Compare them with your normal traffic to see whether the increase is unusual.
2. Turn on DDoS protection
If your hosting provider or security service has DDoS mitigation, make sure it is active. Filtering traffic outside your server is much more effective than asking an already overloaded server to handle the attack itself.
3. Use a CDN and WAF
If they are not already configured, route your website through a CDN and enable your WAF. These layers can help identify and filter unwanted web traffic before it reaches your application.
4. Protect the origin server
Make sure attackers cannot bypass your protection layer and connect directly to the origin IP address. Where supported, restrict origin access to trusted traffic sources.
5. Apply targeted rate limits
Limit excessive requests on endpoints being hit heavily, such as login pages, search, APIs, or other resource-intensive URLs. Avoid setting aggressive limits across the entire website.
6. Contact your hosting provider
Tell your provider that you are experiencing a suspected DDoS attack. They may be able to identify network-level traffic that you cannot see from the server itself and apply additional mitigation.
7. Keep watching the logs
Monitor requests, CPU, memory, bandwidth, connections, and application logs while the attack continues. This can help you understand which parts of your website are being targeted.
Don’t try to block thousands of IP addresses one by one. DDoS traffic can come from many different sources, so manual blocking is slow and may accidentally block genuine visitors. A broader traffic-filtering strategy is usually more effective.
Is DDoS Protection Worth It for a Small Website?
Yes. You don’t need a huge website to have something worth protecting. A small online store can lose sales if customers cannot check out. A business website can lose leads when contact pages stop working. A SaaS application or API can become unavailable when its server is overwhelmed.
The risk is not really about how many visitors you have. It is about how much your website depends on staying available.
If your website supports your business, adding DDoS protection is worth considering. Choosing a hosting provider that already includes protection can also be simpler than building and managing every security layer yourself.
Protect Your Website Before the Traffic Surge Hits
DDoS protection is easier to put in place before an attack starts than while your website is already struggling. The goal is not to make your website impossible to target, but to make sure malicious traffic does not stop genuine visitors from reaching it.
Use multiple layers of protection, keep your origin secure, monitor your normal traffic, and have a clear response plan ready. With the right setup in place, you can respond to unusual traffic faster and reduce the chance of an attack turning into prolonged downtime. Don’t wait for the first outage to find out whether your website is protected.
FAQs:
A DDoS attack floods a website, server, or network with excessive traffic or requests. The traffic consumes available resources and can make the website slow, unavailable, or difficult for genuine visitors to access.
Use layered protection such as DDoS mitigation, a CDN, a WAF, rate limiting, origin protection, and a properly configured firewall. Monitoring normal traffic also helps you identify unusual activity sooner.
No. You cannot guarantee that a website will never be targeted. The practical goal is to detect and filter malicious traffic before it overwhelms your network, server, or application.
Not by itself. A firewall can block certain unwanted connections, but a large DDoS attack may overwhelm the network before traffic reaches the server. DDoS mitigation, CDN protection, and other layers are needed for broader protection.
Cloud-based DDoS mitigation routes traffic through an external protection network before it reaches your server. The service analyzes incoming traffic, filters malicious requests, and allows legitimate traffic to continue toward your website.
Put your store behind DDoS protection and a CDN, enable a WAF, protect the origin server, and apply rate limits to sensitive endpoints. Pay particular attention to login, search, product filtering, cart, checkout, and API requests.
Usually, no. Properly configured DDoS protection should have little noticeable impact on website speed while filtering malicious traffic before it reaches your server.
