What is DDoS and How to Protect Your Website From It

A Distributed Denial of Service (DDoS) attack is one of the most disruptive threats a website can face. Unlike other cyberattacks that try to steal data or exploit vulnerabilities, a DDoS attack simply tries to overwhelm your infrastructure with traffic until it becomes unavailable to legitimate users.

Understanding how DDoS attacks work and how to defend against them is essential for anyone running a website or web application.

What is a DDoS Attack?

A DDoS attack floods a target, usually a web server, network, or application, with so much traffic that it cannot handle legitimate requests. The "Distributed" part means the attack traffic comes from many different sources simultaneously, making it difficult to block by simply filtering a single IP address.

Attackers typically use botnets, networks of compromised computers, IoT devices, and servers that they control remotely. A single botnet can generate hundreds of gigabits per second of malicious traffic from thousands or millions of devices worldwide.

The goal is simple: make your service unavailable. For businesses, this means lost revenue, damaged reputation, and potentially hours or days of downtime.

Types of DDoS Attacks

Volumetric Attacks

These are the most straightforward: flood the target with as much traffic as possible to saturate the network bandwidth. Common volumetric attacks include:

• UDP flood: Sends massive numbers of UDP packets to random ports on the target.
• DNS amplification: Exploits open DNS resolvers to amplify traffic. The attacker sends small queries with a spoofed source IP (your IP), and the DNS server sends large responses to your server.
• NTP amplification: Similar to DNS amplification but uses NTP (Network Time Protocol) servers.

Volumetric attacks are measured in bits per second (bps). Large attacks can exceed 1 Tbps.

Protocol Attacks

These exploit weaknesses in network protocols (Layers 3 and 4) to consume server resources:

• SYN flood: Sends a flood of TCP SYN packets (connection requests) without completing the handshake. The server allocates resources for each half-open connection until it runs out.
• Ping of Death: Sends malformed or oversized ICMP packets.
• Smurf attack: Uses ICMP echo requests with a spoofed source address to flood the target.

Protocol attacks are measured in packets per second (pps).

Application Layer Attacks

The most sophisticated type, these target specific applications (Layer 7) with requests that look legitimate but are designed to exhaust server resources:

• HTTP flood: Sends a high volume of seemingly legitimate HTTP requests to resource-intensive pages.
• Slowloris: Opens many connections to the server and sends partial HTTP headers very slowly, keeping connections open and eventually exhausting the server's connection pool.
• API abuse: Targets specific API endpoints with complex queries that consume significant CPU or database resources.

Application layer attacks are harder to detect because they look like normal traffic. They are measured in requests per second (rps).

Detecting a DDoS Attack

Early detection is crucial. Signs of a DDoS attack include:

• Sudden spike in traffic: An unexpected surge that does not correlate with marketing campaigns, press coverage, or normal traffic patterns.
• Server becoming unresponsive: Pages load slowly or time out entirely.
• Unusual traffic patterns: Traffic from unexpected geographic regions, identical request patterns, or abnormal user-agent strings.
• Resource exhaustion: CPU, memory, or bandwidth hitting 100% without a corresponding increase in legitimate activity.
• Increased error rates: Spike in 503 (Service Unavailable) or 504 (Gateway Timeout) errors.

Monitoring tools that track server metrics, traffic patterns, and error rates help you detect attacks early. Set up alerts for anomalies so you know something is wrong before your users start complaining.

Protection Strategies

CDN and Reverse Proxy

The most effective DDoS mitigation strategy for most websites is placing a CDN or reverse proxy in front of your origin server. Services like Cloudflare absorb and filter attack traffic across their global network before it reaches your server.

Key benefits:

• Your origin IP is hidden behind the CDN
• Attack traffic is absorbed by the CDN's global infrastructure
• Legitimate traffic is served from cached copies, reducing origin load
• Advanced filtering rules distinguish attack traffic from real users

Even Cloudflare's free plan provides substantial DDoS protection. For businesses where uptime is critical, their paid plans offer stronger guarantees and faster mitigation.

Rate Limiting

Limit the number of requests a single IP address can make in a given time period. This is effective against application layer attacks but less useful against distributed attacks where each source IP sends only a few requests.

Implement rate limiting at multiple levels:

• Web server level: Nginx's limit_req_module can throttle requests per IP.
• Application level: Rate limit specific endpoints, especially login pages, APIs, and search functions.
• CDN level: Cloudflare and similar services offer rate limiting rules.

Web Application Firewall (WAF)

A WAF inspects incoming HTTP requests and blocks those that match attack patterns. It can detect and block:

• SQL injection attempts
• Cross-site scripting (XSS)
• Malicious bot traffic
• Known attack signatures

WAFs can be hardware-based, software-based, or cloud-based. Cloud-based WAFs from services like Cloudflare are the most practical for most websites.

Network-Level Protection

Your hosting provider should offer basic network-level DDoS protection. This includes:

• Traffic scrubbing: Filtering malicious traffic before it reaches your server.
• Black hole routing: Temporarily routing all traffic to a null route during extreme attacks (stops the attack but also drops legitimate traffic).
• Anycast networking: Distributing traffic across multiple data centers to absorb volumetric attacks.

When choosing a VPS provider, ask about their DDoS protection capabilities. Providers without any protection leave you vulnerable.

Application Hardening

Reduce your attack surface:

• Limit exposed services: Only expose ports and services that need to be public.
• Optimize resource usage: Tune your web server and database to handle traffic spikes efficiently.
• Use connection limits: Set maximum concurrent connections in your web server configuration.
• Implement CAPTCHA on sensitive endpoints: Prevents automated abuse of forms and login pages.

Incident Response Plan

Have a plan before you need one:

• Detection: Automated monitoring alerts your team.
• Assessment: Determine the type and scale of the attack.
• Mitigation: Activate DDoS protection (enable Cloudflare Under Attack mode, engage your hosting provider's scrubbing service).
• Communication: Notify your team, and if needed, your users.
• Recovery: Once the attack subsides, verify all services are functioning normally.
• Post-mortem: Analyze the attack, identify gaps in your defenses, and improve your protection.

Document this plan, assign roles, and ensure your team knows what to do. During an active attack is not the time to figure out your response process.

The Reality of DDoS

No protection is perfect. A sufficiently large and sophisticated attack can overwhelm any defense. But the goal is not invulnerability. It is raising the cost and difficulty of attacking you enough that attackers move on to easier targets.

For most websites, a combination of Cloudflare (or a similar CDN), proper server hardening, rate limiting, and monitoring provides effective protection against the vast majority of DDoS attacks. The investment in setup time is minimal compared to the cost of hours or days of downtime.