How to Stop DDoS Attacks on Your Website: Prevention & Mitigation Guide

On a normal Tuesday morning, your website loads in under two seconds. By noon, it will not load at all. Your server is overwhelmed by millions of requests from thousands of IP addresses across dozens of countries. Your hosting provider sends you an alert. Your customers call and email asking why the site is down. You are experiencing a Distributed Denial of Service attack, and it can happen to any website at any time.

DDoS attacks increased by 46% in 2025 compared to the previous year, and small and medium businesses are increasingly targeted. The attacks are cheap to launch (as little as $10 per hour on the dark web), difficult to trace, and devastating when unprepared. This guide explains how DDoS attacks work and, more importantly, what you can do to stop them.

What Is a DDoS Attack?

A DDoS (Distributed Denial of Service) attack attempts to make your website unavailable by flooding it with more traffic than it can handle. Unlike a DoS attack (single source), a DDoS attack comes from thousands or millions of devices simultaneously, making it impossible to block by simply banning one IP address.

Attackers typically use botnets — networks of compromised computers, IoT devices, and servers — to generate the flood of traffic. The device owners usually have no idea their machine is part of the attack. Modern botnets can generate attacks exceeding 1 Tbps (terabit per second), enough to overwhelm virtually any single server.

Types of DDoS Attacks

Understanding the different attack types is essential for choosing the right protection strategy. DDoS attacks fall into three main categories:

1. Volumetric Attacks (Layer 3/4)

These are the most common type, accounting for about 65% of all DDoS attacks. They work by saturating your server's bandwidth with massive amounts of junk traffic.

• UDP Flood: Sends massive numbers of UDP packets to random ports on your server. The server must check for applications listening on each port and respond with ICMP "Destination Unreachable" packets, consuming resources.
• ICMP (Ping) Flood: Overwhelms your server with ICMP Echo Request packets. The server must process and respond to each one.
• DNS Amplification: Sends small DNS queries with a spoofed source IP (your server's IP) to open DNS resolvers. The resolvers send much larger responses to your server, amplifying the attack traffic by 28–54x.
• NTP Amplification: Similar to DNS amplification but uses NTP (Network Time Protocol) servers. Can amplify traffic by up to 556x.

2. Protocol Attacks (Layer 3/4)

These exploit weaknesses in network protocols to consume server resources or the capacity of network equipment like firewalls and load balancers.

• SYN Flood: Exploits the TCP handshake by sending a flood of SYN packets without completing the handshake. The server keeps half-open connections in memory, eventually exhausting its connection table.
• Ping of Death: Sends malformed or oversized packets that crash the target system when it tries to reassemble them.
• Smurf Attack: Sends ICMP packets with a spoofed source IP to a network's broadcast address, causing all devices on the network to reply to the victim simultaneously.

3. Application Layer Attacks (Layer 7)

These are the most sophisticated and hardest to detect because they mimic legitimate user behavior. They target specific application features with relatively low traffic volumes.

• HTTP Flood: Sends a large number of seemingly legitimate HTTP requests (GET or POST) to resource-intensive pages like search results, database-heavy pages, or login forms.
• Slowloris: Opens many connections to your server and keeps them open by sending partial HTTP headers at regular intervals. The server waits for each request to complete, eventually running out of available connections.
• WordPress XML-RPC Abuse: Exploits WordPress's XML-RPC API to trigger resource-intensive operations like pingbacks, using your server's own resources against it.

Prevention: Protecting Your Site Before an Attack

1. Use a Content Delivery Network (CDN) with DDoS Protection

A CDN distributes your website's content across dozens or hundreds of servers worldwide. When a DDoS attack hits, the traffic is spread across the entire network instead of hitting a single server. Leading CDN providers include:

• Cloudflare: Offers a free tier with basic DDoS protection and paid plans with advanced mitigation. Their network can absorb attacks exceeding 100 Tbps.
• AWS CloudFront + AWS Shield: AWS Shield Standard is free and protects against most volumetric and protocol attacks. Shield Advanced ($3,000/month) adds protection against application-layer attacks with 24/7 DDoS response team access.
• Akamai: Enterprise-grade DDoS protection with a network capacity exceeding 300 Tbps. Best for large businesses with high traffic.

2. Hide Your Origin Server IP

If attackers know your server's real IP address, they can bypass your CDN and attack the server directly. To prevent this:

• Proxy all traffic through your CDN. Ensure your DNS records point to the CDN, not directly to your server. In Cloudflare, make sure the orange cloud (proxy) is enabled for all records.
• Do not send email from your web server. Email headers reveal the sending server's IP. Use a separate email service (Google Workspace, Microsoft 365, or a transactional email provider like Postmark).
• Check for IP leaks. Use tools like SecurityTrails, Censys, or Shodan to verify your origin IP is not exposed in historical DNS records, SSL certificates, or other public data.
• Restrict origin server access. Configure your server's firewall to only accept connections from your CDN's IP ranges. This ensures that even if someone discovers your origin IP, they cannot connect to it directly.

3. Configure Rate Limiting

Rate limiting restricts how many requests a single IP address can make within a given timeframe. This stops both volumetric attacks and aggressive application-layer attacks.

• Set reasonable limits. A typical visitor might load 20–30 resources per page load (HTML, CSS, JS, images). Rate limiting to 100 requests per minute per IP blocks abusive traffic while allowing legitimate browsing.
• Apply stricter limits to sensitive endpoints. Login pages, search, API endpoints, and form submissions should have lower thresholds (10–20 requests per minute).
• Use progressive rate limiting. Instead of immediately blocking, first add a CAPTCHA challenge, then temporarily block, then permanently block repeat offenders.

4. Deploy a Web Application Firewall (WAF)

A WAF filters malicious traffic before it reaches your server. For DDoS specifically, a WAF can:

• Block known malicious IP addresses and botnets
• Challenge suspicious traffic with JavaScript challenges or CAPTCHAs
• Filter requests based on geographic location (geo-blocking)
• Identify and block application-layer attacks that look like legitimate traffic
• Detect anomalous traffic patterns and automatically increase protection levels

5. Harden Your Server Configuration

• Increase connection limits. Configure your web server to handle more simultaneous connections. For Nginx, increase worker_connections. For Apache, increase MaxRequestWorkers.
• Enable SYN cookies. On Linux, net.ipv4.tcp_syncookies = 1 protects against SYN flood attacks by validating connections without maintaining state.
• Reduce TCP timeout values. Lower tcp_fin_timeout, tcp_keepalive_time, and tcp_tw_recycle to free up connections faster during an attack.
• Disable unnecessary services. Close unused ports and disable services you do not need (ICMP responses, unused protocols, test pages).

Mitigation: What to Do During an Attack

Despite your best prevention efforts, an attack may still get through. Here is a step-by-step response plan:

1. Confirm it is a DDoS attack. Not every traffic spike is an attack. Check if traffic is coming from diverse geographic locations, if requests follow abnormal patterns, and if your server resources (CPU, RAM, bandwidth) are saturated. Your hosting provider can help confirm.
2. Activate "Under Attack" mode. If you use Cloudflare, enable "Under Attack" mode immediately. This adds a JavaScript challenge to every visitor, filtering out most bot traffic. Other CDN providers have similar emergency modes.
3. Contact your hosting provider. Notify your hosting provider immediately. They can apply network-level filtering, null-route specific IP ranges, or activate additional mitigation services. Good providers have 24/7 support for exactly these situations.
4. Apply emergency rate limiting. Temporarily reduce your rate limits to aggressive levels. You may block some legitimate traffic, but keeping your site partially available is better than total downtime.
5. Geo-block if applicable. If the attack traffic is primarily from countries where you have no customers, temporarily block those regions at the CDN or firewall level.
6. Scale up temporarily. If you are on cloud hosting, scale your resources up to absorb more traffic. This buys time while other mitigation measures take effect.
7. Document everything. Record timestamps, traffic logs, attack patterns, and actions taken. This information is valuable for post-attack analysis and for law enforcement if you file a report.

"The best DDoS protection is preparation. The businesses that recover fastest are the ones that have a response plan before the attack starts. Write yours today, not during the attack."

Post-Attack: Recovery and Hardening

After the attack subsides, take these steps:

• Analyze the attack. Review your logs and CDN analytics to understand the attack type, volume, duration, and source. This helps you prepare for future attacks.
• Check for secondary attacks. DDoS attacks are sometimes used as a smokescreen while attackers exploit other vulnerabilities. Scan your site for malware, check for unauthorized access, and review recent file changes.
• Update your response plan. Document what worked, what did not, and what you would do differently. Update your incident response procedures.
• Consider reporting to law enforcement. In many jurisdictions, DDoS attacks are criminal offenses. File a report with your local cybercrime unit, especially if you can identify the attacker or if significant financial damage occurred.
• Evaluate your protection. If your current setup did not adequately protect you, consider upgrading your CDN plan, adding a dedicated DDoS mitigation service, or switching to a hosting provider with better built-in protection.

DDoS Protection Comparison

Frequently Asked Questions

Can a small website be targeted by a DDoS attack?

Absolutely. Small websites are frequently targeted because they typically have less protection. Attacks can come from competitors, disgruntled individuals, or even automated botnets scanning for vulnerable targets. DDoS-for-hire services cost as little as $10 per hour, making attacks accessible to anyone with a grudge.

How long do DDoS attacks typically last?

Most DDoS attacks last between 30 minutes and 4 hours. However, some sophisticated attacks persist for days or even weeks, with varying intensity. The attacker may stop and restart the attack multiple times to test your defenses. Having automated mitigation in place is essential because manual response alone cannot handle sustained attacks.

Can my hosting provider stop a DDoS attack?

Quality hosting providers include network-level DDoS mitigation that filters out most volumetric and protocol attacks automatically. However, large-scale attacks (100+ Gbps) may exceed what a standard hosting provider can handle. For maximum protection, combine your hosting provider's built-in protection with a CDN like Cloudflare.

Is DDoS protection expensive?

Not necessarily. Cloudflare's free plan includes basic DDoS protection. Many modern cloud hosting providers include DDoS mitigation in their standard plans. For most small businesses, these built-in protections are sufficient. Only high-traffic or high-value targets typically need dedicated DDoS mitigation services.

What is the difference between DoS and DDoS?

A DoS (Denial of Service) attack comes from a single source, while a DDoS (Distributed Denial of Service) attack comes from many sources simultaneously. DoS attacks are easy to stop by blocking the single attacking IP. DDoS attacks are much harder to mitigate because the traffic comes from thousands of different IP addresses, making it difficult to distinguish attack traffic from legitimate visitors.