What a DDoS attack is
In a distributed denial-of-service (DDoS) attack, many machines, usually hijacked computers, routers and servers, send traffic at your website at the same time, so real visitors cannot get through. It does not steal data; it takes you offline, which for a shop or a booking site means lost sales.
The three layers of attack
- Network floods (layers 3 and 4): huge volumes of packets that fill the connection to your server. Only a large network in front of the server can absorb these; a server or plugin cannot.
- Application floods (layer 7): many ordinary-looking web requests, often to slow pages such as search, login or checkout, that exhaust the server's CPU or database.
- Aggressive bots: scrapers, credential-stuffing tools and vulnerability scanners that are not meant as an attack but have the same effect on a small server.
What protects you
- An edge network in front of your site that absorbs network floods before they reach your hosting.
- Rate limits on expensive pages, so one visitor cannot request them hundreds of times a minute.
- A browser check (challenge) for suspicious visitors, and an "under attack" mode that puts one in front of every visit while a flood lasts.
- Caching of static files and, where possible, pages, so most requests never reach the server.
- An origin that accepts traffic only from the protection layer, so attackers cannot go around it to your server's IP address.
What does not help much
- A firewall plugin inside the CMS: by the time it runs, the request has already used your server's resources.
- Blocking single IP addresses by hand: a real DDoS comes from thousands of them.
- Upgrading the server: it buys time against small floods but not against a network flood.
How to tell an attack from a busy day
- Real visitor spikes follow a cause: a newsletter, a sale, a mention. Traffic comes from many referrers and spreads across many pages.
- Floods hammer one or a few URLs, often search, login, checkout or a random query string that bypasses the cache.
- Attack traffic often comes from data-centre networks and countries you do not normally serve, with odd or empty user agents.
- Your server is slow while the number of orders, sign-ups or contact messages does not rise with the traffic.
Bots that act like an attack
Many slowdowns on small sites are not deliberate attacks: AI and SEO crawlers that ignore crawl limits, vulnerability scanners probing thousands of paths, and credential-stuffing tools trying stolen passwords on the login page. The same tools help: rate limits per visitor, a browser check for scripted clients, blocking paths nobody should request, and automatic bans for addresses that keep attacking. Genuine search engine crawlers are worth keeping; verify them by their published address ranges rather than by the user agent, which anyone can fake.
Prepare before it happens
- Know how to switch on your strongest protection in one step, and who in your team can do it.
- Have monitoring that alerts you when the site is down or slow, so you hear about it before customers.
- Keep a short note with your hosting provider's emergency contact and your DNS login.
- Make sure static files are cached at the edge, so a flood does not need to reach your server for them.
During an attack
- Confirm it is an attack, not a broken deploy or a traffic spike from a mention: check the server and the request logs.
- Switch on under attack mode or the strongest challenge your protection offers.
- Add rate limits to the pages being hit, and block paths that should not receive traffic at all.
- Tell your hosting provider; they may see the attack on their network too.
- Afterwards, make sure your server's real IP is not exposed in DNS records such as
mail.orftp.hostnames, and lock it down to accept only protected traffic.
How Webforta Shield helps
Webforta Shield (Pro and Business) runs on a global edge network that provides always-on layer 3, 4 and 7 DDoS mitigation. On top of that it adds per-visitor rate limits, login flood protection, automatic bans for repeat attackers, a proof-of-work browser check and an under attack mode you can switch on in one click. Shield protects the traffic that goes through it, so lock down your origin as well.