A DDoS attack (distributed denial-of-service) floods a website or online service with traffic from thousands of machines at once until it collapses and genuine customers cannot get through. Nothing is stolen and no password is cracked — the damage is downtime: a store that cannot sell, a booking system that cannot take appointments, a portal that cannot log anyone in. In 2026 the traffic comes mostly from botnets of hijacked consumer and IoT devices, and attacks have become a rentable service, which is why even small businesses that simply run a popular site can be hit.
TL;DR
- A DDoS attack overwhelms a site with junk traffic from thousands of hijacked machines until legitimate users are locked out.
- The damage is lost revenue and reputation, not stolen data — but downtime frequently arrives alongside an extortion attempt.
- Attacks are cheap to rent and botnets of routers, cameras and old PCs supply the volume.
- The fix sits upstream: a DDoS protection or CDN layer in front of your site absorbs the flood before it reaches you.
- Staff still need training — a busy help desk is the second front of any DDoS incident.
What is a DDoS attack?
Denial of service means making a service unavailable. The first D is what makes it powerful: distributed. One attacker's laptop cannot overload a modern website, but a botnet — thousands of infected devices acting on one attacker's command — can. That is the same machinery described in what is a botnet: routers, cameras, office PCs and phones infected with malware and quietly awaiting instructions.
The flood comes in three broad flavours:
- Volume attacks saturate your bandwidth with garbage traffic such as UDP floods. The pipe fills; nothing else fits.
- Protocol attacks exhaust server or firewall resources with malformed handshakes such as SYN floods.
- Application-layer attacks send requests that look legitimate — repeated page loads, login attempts, API calls — and exhaust the application itself. These are the hardest to separate from real customers.
What happens during an attack
- The botnet fires. Thousands of devices start sending traffic to your site simultaneously.
- Resources exhaust. Bandwidth, connection tables, memory or application threads fill up within minutes.
- The service degrades or dies. Pages time out; checkouts fail; nobody can log in.
- The side effects spread. Customers call, support is overwhelmed, and depending on your provider's policy your hosting costs spike or the host suspends the site to protect its other customers.
Many attacks come with a ransom note — pay in cryptocurrency or the flood continues. Paying invites the next demand; the reliable response is capacity you arranged in advance.
Who gets hit and why
- Everyone with a visible online service. Attackers target gaming, retail, finance and government most, but any site with a public IP can be a target — including as collateral when the botnet sprays broadly.
- Rivalry and grudges. Competitors, disgruntled ex-staff and online feuds all end in DDoS attacks.
- Extortion. A flood is the demonstration; the invoice follows.
- Distraction. Security teams firefighting downtime are not watching the credential-stuffing or ransomware attempt running in the background — the quiet crime is often the point.
How to stop a DDoS attack
You cannot out-buy a botnet with a bigger server. The defence is an upstream layer that absorbs the flood before it reaches your systems:
- Put a protection layer in front of your site. A CDN or DDoS mitigation service (Cloudflare, AWS Shield, Akamai and similar) filters junk traffic at their edge. This single step handles the overwhelming majority of attacks.
- Never expose origin servers directly. Your real hosting IP should accept traffic only from the protection layer; a leaked origin IP is the classic bypass.
- Scale and rate-limit. Auto-scaling buys time; rate limiting and request validation on logins and APIs blunt application-layer floods.
- Have the incident plan written. Who calls the provider, who talks to customers, what the status page says. Decide before the attack, not during it.
- Keep the human channel ready. During downtime the phone lines, inbox and socials take the load. A team that knows the plan answers confidently; one that does not improvises in public.
A cyber security gap assessment is a practical way to find which of these layers — protection service, origin isolation, incident plan — your business is missing.
DDoS vs a normal traffic spike
| DDoS attack | Genuine traffic spike | |
|---|---|---|
| Traffic source | Thousands of geographies, no intent to browse | Real users, normal browsing behaviour |
| Pages viewed | Single URL hammered, or random paths | Many pages, sensible journeys |
| Pattern | Sudden cliff-edge surge | Builds over hours or days |
| What breaks | Bandwidth, connections, app | Slower load times |
| Response | Mitigation service absorbs it | Scale up and enjoy it |
What to do in the first hour
- Confirm it is a DDoS and not a hosting failure or a genuine spike — check the traffic source distribution.
- Enable maximum protection level on your CDN or mitigation service, or engage your provider's response team.
- Block the worst paths if the attack targets a specific endpoint, without locking out customers.
- Communicate: status page, then email or social. Silence converts a technical incident into a trust problem.
- Afterwards, close the gap that let the attack hurt you — origin exposure, no mitigation layer, no plan.
FAQ
What is a DDoS attack in simple terms? An attack that floods a website or online service with traffic from thousands of hijacked machines until real customers cannot use it. Nothing is stolen — the goal is downtime.
How is a DDoS attack different from a DoS attack? A DoS attack comes from one machine; a distributed DoS comes from a botnet of thousands, which is what gives it the volume to take down protected services.
Why would anyone attack a small business? Extortion, grudges, competition — and collateral damage, because broad botnet attacks sweep up every site in their path. Attacks are also rented cheaply, so the barrier to motive has collapsed.
Can a DDoS attack steal data? The flood itself steals nothing. But attackers sometimes launch one as a distraction for a quieter intrusion, so treat any DDoS as a prompt to check access logs.
How do I protect my website from DDoS attacks? Put a CDN or DDoS mitigation service in front of the site, hide your origin server's IP so traffic must pass through the protection layer, rate-limit logins and APIs, and keep a written incident plan.
One last thing
Check today whether your website's real hosting address is hidden behind a protection layer. If your origin IP is public, every other defence you bought can be bypassed with one DNS lookup — and that single fix costs nothing but an afternoon of configuration.