DoS and DDoS Attacks: How They Work and How We Protect the Server

A denial-of-service attack floods a server with requests until it cannot serve your real visitors. At Hyyat Host the CSF firewall on our servers provides tools to limit connections and block abusive addresses automatically. This page explains the attack types, the signs, the honest limits of each protection, and what to do if your site is a repeated target.

DoSCSF · LFD · ImunifyAV
CSFper-IP connection limits
Auto-blockingof abusive addresses
Port protectionagainst connection floods
CDNfor large distributed attacks

What is a DoS attack and how is it different from DDoS?

A denial-of-service (DoS) attack aims to take your service offline by flooding the server with more requests or connections than it can handle. Some attacks need just one machine, like Slowloris, which opens many connections and keeps them hanging until the web server is full.

A DDoS attack is distributed, coming from thousands of machines at once, often botnets. Attacks are not limited to websites over HTTP; they can target other services such as SSH, FTP and email.

In short: A DoS attack floods the server from one or a few sources, while DDoS comes from thousands of machines. We limit the first on Hyyat Host servers with CSF tools; very large distributed attacks are stopped at network level or by CDN services.

Signs of a denial-of-service attack

Sudden slowness across all sites on the server
A big jump in CPU and memory load
503 or 508 errors and sites going down
A huge number of connections from a few addresses
Unable to reach the control panel or SSH
Logs full of repeated requests for the same page

How a denial-of-service attack unfolds: 4 stages

Understanding the stages of an attack helps you stop it early, before it reaches your data and visitors.

  1. Choosing a targetThe attacker picks a site or service, sometimes starting with a few requests to measure server capacity.
  2. FloodingRequests or connections pour in from one machine, or from thousands in DDoS attacks.
  3. Exhausting resourcesWeb server capacity, memory or bandwidth fills up, the server slows down and then stops.
  4. Blocking and recoveryThe source is blocked and requests are reduced, and the server recovers once the pressure is gone.

How we limit DoS attacks on our servers

No single protection stops every attack, so we rely on tools that work together, and we are honest about their limits:

These tools run on our hosting servers and on servers we protect under the server management service.

  1. CSF connection trackingWatches the number of connections from each IP and temporarily blocks any address that exceeds the limit.
  2. Port and SYN flood protectionCSF supports rate limits on ports and SYN flood protection, which we tune to each server needs.
  3. LFD for repeat offendersAn address blocked again and again is blocked for longer, so the same attacker cannot easily return.
  4. For large distributed attacksHuge attacks from thousands of machines are stopped before they reach the server, through network protection or CDN services, which we recommend if your site is a repeated target.

What to do if your site is attacked

Server protection is half the way; the other half is in your hands. These simple steps make a big difference.

  1. Contact support immediatelySend when the problem started and the affected sites; it shortens the analysis.
  2. Use a CDNA CDN absorbs a large share of requests before they reach your server.
  3. Enable cachingCached pages serve visitors with fewer resources, so the site holds up longer.
  4. Protect login pagesThe WordPress login page and xmlrpc.php are among the most targeted by repeated requests.
  5. Watch performanceA sudden spike from one country or address is a sign worth attention.
  6. Choose the right serverLarge sites need a VPS or dedicated server with independent resources and protection.

Terms worth knowing

DoS
A denial-of-service attack from one or a few sources, aiming to take a site or service offline.
DDoS
A distributed denial-of-service attack from thousands of machines at once, usually botnets.
SYN flood
Flooding the server with connection requests that never complete until its pending queue is full.
Slowloris
An attack that keeps many connections open deliberately slowly so the web server has no room for visitors.
CDN
A network of servers around the world that serves your site and absorbs much of the traffic before it reaches the server.

Who is responsible for protecting your server?

Shared and WordPress hosting

We manage server protection fully: the CSF firewall, LFD blocking, ImunifyAV scanning and mail filtering. You keep your site updated and your passwords safe.

Shared hosting →

VPS and dedicated servers

The server is fully yours, and its protection is your responsibility unless you subscribe to server management, where we install, tune and monitor the protection tools.

Server management → · VPS · Dedicated servers

Frequently asked questions

Did not find your answer? Ask us on WhatsApp or visit the customer service center.

What is the difference between DoS and DDoS?

A DoS attack comes from one or a few machines, while DDoS is distributed, coming from thousands of machines at once.

Does Hyyat Host protect servers from DoS attacks?

Yes, the CSF firewall on our servers provides per-address connection limits and automatic blocking of abusive addresses, which stops small and medium attacks.

Can any DDoS attack be stopped, whatever its size?

No server-level protection can stop huge distributed attacks on its own; those are stopped at network level or by CDN services before reaching the server.

What is a Slowloris attack?

An attack that opens many connections to the web server and sends data very slowly until the server is full; one machine is enough.

How do I know my site is under attack?

Signs include sudden slowness, 503 or 508 errors, high load and many connections from a few addresses. Contact support to analyse the logs.

Do I need a dedicated server for better protection?

Large or targeted sites benefit from a VPS or dedicated server with independent resources, plus server management to tune protection to their needs.

What is the difference between network and application DDoS?

Network attacks flood the connection itself with huge volume, while application attacks send normal-looking requests to heavy pages. DDoS protection for a server against large attacks needs network protection or a CDN.

Can an attack on another site affect mine on shared hosting?

It may cause temporary slowness because resources are shared, which is why DoS protection blocks the source quickly to limit the impact on other sites.

Want someone to handle your server security?

With server management we install, tune and monitor the protection tools, so you can focus on your business.

Contact us on WhatsApp