What a DDoS attack actually is
DDoS stands for Distributed Denial of Service. Break that down and it explains itself: the goal is denial of service, meaning your website becomes unavailable, achieved by flooding it with far more traffic or connection requests than it can handle. Distributed means that flood doesn't come from one source, it comes simultaneously from potentially thousands of compromised devices scattered across the internet, often without their owners ever knowing their device is involved.
The server underneath your website has finite capacity to process requests, hold open connections, and serve responses. A DDoS attack simply exceeds that capacity with junk traffic, so there's nothing left over to serve the people who actually want to visit your site.
The three broad types
- Volumetric attacks aim to saturate your available bandwidth with sheer volume, the digital equivalent of clogging a road with far more cars than it was built for.
- Protocol attacks exploit weaknesses in how servers establish connections, tying up server resources with incomplete or malformed connection requests rather than raw traffic volume.
- Application-layer attacks mimic real visitor behaviour, sending what look like legitimate page requests, but at a volume and pattern no real audience would generate. These are the hardest to filter automatically because each individual request can look completely normal.
Why small business sites get targeted too
It's a common assumption that DDoS attacks only target large, high-profile companies. In practice, small and mid-sized business sites get hit for reasons that have nothing to do with size: a competitor trying to disrupt a launch or sale, an extortion attempt demanding payment to stop, a disgruntled former employee or customer, or simply an automated tool being tested against a random list of targets with no specific grievance involved at all. That last category is more common than people expect. Being small doesn't make you invisible to automated scanning.
What actually mitigates a DDoS attack
| Layer | What it does |
|---|---|
| Upstream network filtering | The data centre's own network identifies and drops obviously malicious traffic patterns before they reach individual servers |
| Rate limiting | Caps how many requests a single source can make in a given window, slowing down automated floods |
| CDN / proxy layer | Routes traffic through a distributed network that can absorb and filter large volumetric floods before they ever touch your actual server |
| Web application firewall | Inspects application-layer traffic for attack patterns that raw network filtering can't distinguish from real visitors |
Baseline network filtering, applied at the data centre level, handles the majority of small to moderate scale attempts without you ever noticing anything happened. A large, sustained, deliberately targeted attack against a specific high-profile site is a different scale of problem, and typically needs a dedicated CDN or scrubbing layer in front of the site specifically, rather than relying on general shared hosting protection alone.
Every WebSpaceBar account sits behind our data centre's baseline network-level traffic filtering as standard. If you're running a high-visibility campaign, handling significant transaction volume, or operating in a space where you'd reasonably expect elevated risk, talk to us about adding a CDN layer in front of your specific site for extra headroom.
Questions to ask your host
- "What happens automatically if my site starts receiving an unusual traffic spike?"
- "Is filtering applied at the network level, or only after a problem is already noticed and reported?"
- "If a real attack does get through, what's the actual recovery process?"
That last question connects directly to backup and replication strategy: even if an attack does cause temporary disruption, a host with solid failover architecture gets you back online faster than one relying purely on prevention with no real recovery plan behind it.
Concerned about a specific risk?
If you're planning a launch, a sale, or a campaign you expect to draw attention, talk to us beforehand so we can plan the right level of protection for it.
Frequently asked questions
Can a small business website actually get hit by a DDoS attack?
Yes. Motives include competitor sabotage, extortion attempts, disgruntled former employees or customers, and automated tools being tested against random targets with no personal motive at all. Site size or profile has little bearing on whether it becomes a target.
Does shared hosting protect against DDoS attacks?
Most reputable hosts apply some baseline network-level traffic filtering upstream, which absorbs small to moderate scale attacks before they reach individual servers. A large, sustained volumetric attack against a specific high-profile target usually needs dedicated scrubbing capacity or a CDN layer beyond what standard shared hosting provides on its own.
What's the difference between a DDoS attack and hacking?
A DDoS attack doesn't break into your website or steal data; it floods your server or network with traffic until real visitors can't get through, aiming to take the site offline rather than compromise it. Hacking specifically targets unauthorised access, data theft, or code injection, which is a different threat requiring different defences.
Should every website have a CDN for DDoS protection?
Not necessarily. A standard business brochure site or blog is a low-probability target and is usually adequately covered by a host's baseline network filtering. Sites running high-profile campaigns, handling significant e-commerce volume, or operating in a competitive or contentious space carry higher risk and benefit more from an additional CDN layer.