In shortA distributed denial of service (DDoS) attack sends a huge number of requests to your site from thousands of devices at once, until the server cannot serve real visitors and the site slows down or stops. It does not steal data, but it stops your business. Protection comes in layers: a server firewall, cloud protection such as Cloudflare in front of the site, and limits on requests per address.
How does the attack work? #
The attacker controls a network of infected devices (a botnet): computers, cameras and routers around the world. They tell all of them to send requests to your site at the same moment. Because the requests come from thousands of addresses, blocking one is not enough.
Types of DDoS attacks #
| Type | How it works | Example |
|---|---|---|
| Volumetric | Fills the internet connection with huge amounts of data. | UDP floods |
| Protocol | Exhausts server and network resources with half-open connections. | SYN flood |
| Application layer | Requests heavy pages such as search or login over and over. | HTTP flood, Slowloris and the load-scripts flaw |
Signs your site is under attack #
- Sudden severe slowness or downtime with no change from you.
- A big jump in traffic from unusual countries or addresses.
- Many requests to a single page, such as search or wp-login.php.
- Hitting your plan’s resource limits in a short time.
How to protect your site #
- Put cloud protection in front: Cloudflare receives traffic before your server and filters large attacks. During an attack, turn on Under Attack mode.
- Rate limit requests: Especially for login and search pages, so one address cannot send hundreds of requests a minute.
- Lighten heavy pages: Caching lets the server deliver a ready page instead of building it for every request.
- Block bad bots: Read bad bots and how to block them.
- Do not expose your server address: If you use Cloudflare, do not publish the server’s real IP in exposed DNS records.
Should you pay the attacker? Some attackers demand money to stop. Do not pay: it guarantees nothing and invites repeats. Contact us and we will help you defend.
How Hyyat Host protects your site #
- The CSF firewall limits connections per address and blocks attacking addresses.
- Imunify360 detects suspicious automated requests, and CloudLinux isolates accounts so an attack on another site does not take yours down.
- You can connect your site to Cloudflare for a protective layer in front of the server.
Learn more about Hyyat Host DoS protection.
Frequently asked questions #
What is the difference between DoS and DDoS?
A DoS attack comes from one machine, so it is easy to block. A DDoS comes from thousands of machines at once, so it needs layered protection.
Does a DDoS attack steal my data?
No. Its goal is to stop the site. Sometimes it is used as a distraction from another attack, so review your site’s security afterwards.
Is Cloudflare free?
The free plan includes basic DDoS protection, which is enough for most small and medium sites.
Related guides
