A DoS attack is a flood of junk traffic aimed at a website until real customers can't get through, like a crowd blocking your shop door. A DDoS (distributed DoS) does the same from many hijacked machines at once, and it's the form you're likely to meet. It attacks availability, and the attack itself steals nothing. Should you worry? Less than the headlines suggest. Targeted attacks on small businesses are relatively uncommon, and basic protection is cheap, often free, or already part of modern hosting.
DoS vs. DDoS in one minute
A DoS comes from one source sending overwhelming or malformed traffic. It's rare now, because a single source is easy to block. A DDoS is the distributed version. The attacker rents or controls a "botnet" of compromised devices around the world and points them all at one target. From your side the two look the same: the site crawls, then stops responding. The distributed kind is the reason the defense happens at the network level, upstream of your server.
What an attack looks like from your side
- The site suddenly slows to a crawl or can't be reached at all, often with no error message, only endless loading.
- Your hosting dashboard shows a huge traffic spike from nowhere: thousands of "visitors" and no matching sales or inquiries.
- Your host emails about resource limits, or suspends the site on its own initiative to protect its other customers.
Before you call it an attack: an expired certificate, a hosting failure, a bad plugin update or a surge of real attention (a mention that goes viral) can all look like one from the outside. Diagnose before you assume malice.
Most small businesses aren't the target
Big DDoS campaigns tend to follow news, money, politics and grudges: media and government sites during a crisis, gaming and finance platforms, or a business someone is trying to extort. A typical local-service or small e-commerce site is more likely to be worn down by indiscriminate bot traffic, the scrapers and credential-stuffing bots that drag performance down without "attacking" you in particular. The protections below cover both.
Protect the site, starting with the cheapest steps
- Check what you already have. Ask your host one question: "Is DDoS mitigation included in my plan?" Many modern hosts and platforms include network-level protection by default.
- Put a protective layer in front. A CDN or security service (Cloudflare is a well-known example, and many hosts have equivalents) absorbs and filters hostile traffic before it reaches your site. Free tiers exist, and they do real work.
- Keep the site lean and cached. A fast, cached site rides out traffic spikes, hostile or viral, far better than a heavy one. (Related: why is my site slow?)
- Know your host's emergency contact before you need it, and keep an off-site copy of your site so recovery never depends on one vendor's worst day.
If it's happening right now
Call your host first, because mitigation happens at their level. Don't pay extortion demands. Report them instead (in the US, the FBI's IC3 takes these reports). Once things are stable, check your admin accounts and logs as a precaution, since outages are occasionally used as cover. Then put the protective layer above in place, so you're better prepared for round two.
DoS questions owners ask
Does a DoS attack mean my data was stolen?
No. A DoS attack targets availability, and your data isn't the target. It blocks the door instead of breaking in. Outages are occasionally used as noise around other attacks, though, so if you're hit, check your accounts and logs afterward as a precaution.
Is my small business at risk of a DDoS attack?
Targeted attacks on small businesses are relatively uncommon, and an outage that looks like one can just as easily be a hosting or configuration problem. Much of the hostile traffic a small site sees comes from indiscriminate bots. The sensible protection is inexpensive: hosting or a CDN with DDoS mitigation included, which many providers bundle by default.
Can I stop a DDoS attack myself?
Not from your own server. The traffic has to be absorbed upstream, which is your host's and your CDN's job. Your part is making sure that layer exists before you need it.
Check your security posture the measured way
The Grader reads Security as one of its six lenses, from the certificate and redirects to the security headers, and explains it without the fear-mongering. The engine runs in sample mode while live scanning rolls out.
Grade my site Fix a "Not Secure" warning