---
title: What Are DDoS Attacks? Types, Warning Signs and How to Protect Your Website
description: "**In short**A distributed denial of service (DDoS) attack sends a huge number of requests to your site from thousands of devices at once, until the server cannot serve real visitors and the site slows down or stops. It does not…"
url: "https://www.hyyat.com/en/knowledgebase/ddos-attacks-protection/"
updated: "2026-10-22"
category: Website Security
---

# What Are DDoS Attacks? Types, Warning Signs and How to Protect Your Website

**In short**A distributed denial of service (DDoS) attack sends a huge number of requests to your site from thousands of devices at once, until the server cannot serve real visitors and the site slows down or stops. It does not steal data, but it stops your business. Protection comes in layers: a server firewall, cloud protection such as Cloudflare in front of the site, and limits on requests per address.

![DDoS attack: many requests from multiple sources stopped by a shield before reaching the server](https://www.hyyat.com/wp-content/uploads/2026/10/hkb-ddos.webp)

## How does the attack work?

The attacker controls a network of infected devices (a botnet): computers, cameras and routers around the world. They tell all of them to send requests to your site at the same moment. Because the requests come from thousands of addresses, blocking one is not enough.

## Types of DDoS attacks

| Type | How it works | Example |
| --- | --- | --- |
| Volumetric | Fills the internet connection with huge amounts of data. | UDP floods |
| Protocol | Exhausts server and network resources with half-open connections. | SYN flood |
| Application layer | Requests heavy pages such as search or login over and over. | HTTP flood, [Slowloris](https://www.hyyat.com/en/knowledgebase/what-is-a-slowloris-ddos-attack/) and [the load-scripts flaw](https://www.hyyat.com/en/knowledgebase/wordpress-load-scripts-vulnerability/) |

## Signs your site is under attack

- Sudden severe slowness or downtime with no change from you.
- A big jump in traffic from unusual countries or addresses.
- Many requests to a single page, such as search or wp-login.php.
- Hitting your plan’s resource limits in a short time.

## How to protect your site

1. **Put cloud protection in front:** Cloudflare receives traffic before your server and filters large attacks. During an attack, turn on [Under Attack mode](https://www.hyyat.com/en/knowledgebase/cloudflare-under-attack-mode/).
2. **Rate limit requests:** Especially for login and search pages, so one address cannot send hundreds of requests a minute.
3. **Lighten heavy pages:** Caching lets the server deliver a ready page instead of building it for every request.
4. **Block bad bots:** Read [bad bots and how to block them](https://www.hyyat.com/en/knowledgebase/block-bad-bots/).
5. **Do not expose your server address:** If you use Cloudflare, do not publish the server’s real IP in exposed DNS records.

 **Should you pay the attacker?** Some attackers demand money to stop. Do not pay: it guarantees nothing and invites repeats. Contact us and we will help you defend.

## How Hyyat Host protects your site

- The **CSF** firewall limits connections per address and blocks attacking addresses.
- **Imunify360** detects suspicious automated requests, and **CloudLinux** isolates accounts so an attack on another site does not take yours down.
- You can connect your site to **Cloudflare** for a protective layer in front of the server.

Learn more about [Hyyat Host DoS protection](https://www.hyyat.com/en/dos-detection/).

## Frequently asked questions

   What is the difference between DoS and DDoS?

A DoS attack comes from one machine, so it is easy to block. A DDoS comes from thousands of machines at once, so it needs layered protection.

   Does a DDoS attack steal my data?

No. Its goal is to stop the site. Sometimes it is used as a distraction from another attack, so review your site’s security afterwards.

   Is Cloudflare free?

The free plan includes basic DDoS protection, which is enough for most small and medium sites.

   **Related guides**

- [What Is a Slowloris DDoS Attack and How to Protect Your Server](https://www.hyyat.com/en/knowledgebase/what-is-a-slowloris-ddos-attack/)
- [The WordPress load-scripts.php Vulnerability (CVE-2018-6389) and How to Protect Your Site](https://www.hyyat.com/en/knowledgebase/wordpress-load-scripts-vulnerability/)
- [Brute Force Attacks: How They Work and How We Protect Your Site](https://www.hyyat.com/en/knowledgebase/brute-force-protection/)
- [What Is a Web Application Firewall (WAF) and How Does It Protect Your Site?](https://www.hyyat.com/en/knowledgebase/what-is-waf-web-application-firewall/)

[All website security guides →](https://www.hyyat.com/en/kb/website-protection/)

  **Need this service from Hyyat Host?**Our team handles it for you, with support replying to tickets within 24 hours at most.[Web Hosting](https://www.hyyat.com/en/hosting/)[Saudi Hosting](https://www.hyyat.com/en/saudi-hosting/)