MHOSTMHOST

What Is a DDoS Attack in Simple Terms, and Who Is at Risk

A DDoS attack is an attempt to knock a website or server offline by flooding it with so many requests that it can no longer answer real visitors. Nothing gets hacked or stolen — the site simply becomes unreachable, and the business loses customers and money for as long as the attack lasts.

How it works: the shop analogy

Imagine a small shop that a thousand people walk into at once. They don't buy anything; they just crowd the checkouts and ask questions. Real customers can't get inside and go to a competitor.

A DDoS does the same to a server. The first D stands for Distributed: requests come not from one computer but from thousands or millions of devices around the world. Usually that's a botnet — infected computers, routers and security cameras whose owners don't even know they're part of an attack. That's why you can't stop it by simply blocking one IP address.

Types of DDoS attacks

Volumetric attacks. They clog the network link with junk traffic, like a traffic jam on the only road to your server. The server may be perfectly healthy, but nothing gets through to it.

Protocol attacks. They abuse quirks of network protocols to exhaust the resources of the server or network equipment — for example, flooding the server with half-open connections it has to keep in memory.

Application-layer (L7) attacks. The trickiest kind: bots imitate normal visitors and hit "heavy" pages — search, cart, login form. Traffic may be modest, but each request makes the server and database work hard. These attacks are the hardest to tell apart from real customers.

Why people launch DDoS attacks

  • Competition. An online store goes down on Black Friday, and shoppers go to whoever is still online.
  • Extortion. The site is hit for a couple of minutes, then an email arrives: "Pay up or the attack comes back."
  • Revenge and mischief. An angry customer, a banned player, a former employee. Renting a botnet is cheap, so almost anyone can launch an attack.
  • Politics and activism. Attacks on government sites, media, banks and infrastructure.
  • Distraction. While admins fight the DDoS, attackers try to break into something else.

Who is at risk

A common myth is that "only big companies get attacked." In fact a small site is easier and cheaper to take down, and it usually has no protection. High-risk groups include:

  • online stores, especially during sales season;
  • game servers: Minecraft, CS2, Rust — they're attacked more than anyone;
  • services with online payments, crypto and fintech projects;
  • media, bloggers and forums covering sensitive topics;
  • sites in competitive niches: delivery, services, ticketing.

Sometimes a site suffers by accident: the attack targets a neighbor on the same server or subnet, and everyone goes down.

How to tell an attack is happening

  • the site suddenly becomes very slow or returns 502, 503 or 504 errors;
  • analytics show a sharp traffic spike with no rise in sales or leads;
  • lots of requests come from unusual countries or hit the same page;
  • server CPU or network load is maxed out for no obvious reason;
  • your host sends a notice or temporarily null-routes your IP address.

A real traffic surge after an ad campaign or press mention can look similar. The difference is that real people do things on the site, while bots just hammer pages.

What an attack costs a business

  • Lost revenue for every hour of downtime.
  • Wasted ad spend: ads keep sending people to a site that doesn't work.
  • Lost search rankings: if search crawlers get errors for long or often, pages can drop.
  • Reputation: customers remember that "the site is always down" and switch to competitors.

How to protect against DDoS

You can't rule out an attack completely, but you can stop it from reaching your server. The main approaches:

  • Protection at the host level. Traffic passes through data center filters that drop junk packets before they reach your server. Works well against volumetric attacks.
  • A proxy or CDN (for example, Cloudflare). Visitors connect to the provider's network instead of your server directly, and that network absorbs the hit. Your server's real IP stays hidden.
  • WAF and bot filtering. Checks whether a visitor is human and stops application-layer attacks.
  • Rate limiting. One IP can't send more than a set number of requests per second. A simple measure that stops small attacks.
  • Spare capacity and caching. The faster your site serves pages, the more requests it can take before it falls over.

The best results come from combining them: host-level protection against volumetric attacks plus a proxy with a WAF against application-layer attacks.

What to do if your site is under attack

  1. Don't pay extortionists. Paying doesn't guarantee the attack will stop, and it shows you're an easy target.
  2. Contact your host's support right away. They have access to network filters and traffic data.
  3. Turn on proxy protection if you don't have it yet, and enable its stricter visitor-check mode.
  4. Warn your customers on social media or messengers that maintenance is in progress.
  5. Keep the logs and any threatening emails. You'll need them for a report to the police cybercrime unit.

FAQ

What's the difference between DDoS and DoS?

A DoS attack comes from a single source and is easy to stop by blocking one IP. A DDoS comes from thousands of devices at once, so it needs dedicated protection.

Can a DDoS steal data?

Not by itself: its goal is to make the site unavailable. But sometimes it's used as a distraction while attackers try to break into something else.

How long does an attack last?

From a few minutes to several days. Most attacks are short but repeated, to wear the site owner down.

Does a small site need protection?

Yes, if the site makes money. Basic proxy protection takes an hour to set up and is often free, while downtime costs far more.

← All articles