Quick answer: A distributed denial of service (DDoS) attack floods your website or server with so much traffic, from so many sources, that real visitors cannot get through. Small sites are targeted too, sometimes on purpose and often as collateral damage. The most practical DDoS protection for a small business is to put the site behind a reverse proxy service with DDoS mitigation (such as Cloudflare, Sucuri or a similar provider), hide your server’s real IP address, cache as much as possible, rate limit login and form pages, choose a host that can absorb or filter attacks, and keep a short plan for what to do when it happens.
What a DDoS attack is
In a simple denial of service attack, one machine sends more requests than a server can handle. A distributed attack does the same from thousands of machines at once, often compromised computers, routers and cameras organized into a botnet. Because the traffic comes from everywhere, blocking a single address does not help.
Attacks generally fall into two groups.
Network level attacks (often called layer 3 and 4 attacks) try to overwhelm the connection itself with huge volumes of packets. Examples include UDP floods, SYN floods and amplification attacks that abuse public services to multiply traffic. These are usually too large for a single server or small hosting account to survive on its own.
Application level attacks (layer 7) send requests that look like normal visitors, such as loading pages, running searches or submitting login forms. They need far less traffic to cause trouble because each request makes the server do real work: running code, querying the database, building a page.
Why small businesses get hit
It is easy to assume only banks and big brands face DDoS attacks. In practice, small sites are affected for several reasons:
- Cheap attack services. So called “booter” or “stresser” services rent out attacks for small sums, so a grudge, a competitor or a bored teenager can launch one.
- Extortion. Some attackers threaten or start an attack and demand payment to stop.
- Shared hosting. If another site on your server is attacked, your site can go down with it.
- Automated abuse. Aggressive bots hammering login pages or search forms can act like a small application level attack, even without a clear motive.
- Distraction. An attack can be cover for another attempt to break in.
The cost for a small business is real: lost sales, missed leads, support time and, if it lasts, damage to reputation.
Layer 1: a reverse proxy with DDoS mitigation
The single most effective step is to route traffic through a service that sits in front of your server. Visitors connect to the service, which filters bad traffic and passes the rest to your site.
These services run large networks spread around the world, so they can absorb traffic volumes that would flatten a single server. Many also cache your pages, which reduces load and speeds up the site for normal visitors.
Common options include:
- Cloudflare, which includes unmetered DDoS mitigation on all plans, including the free plan, with more control and support on paid plans
- Sucuri, a website firewall and CDN with DDoS protection, often chosen alongside malware cleanup services
- Larger enterprise providers such as Akamai, and cloud provider services like AWS Shield for sites hosted on AWS
Setup usually means changing your domain’s DNS or nameservers to the provider. Our guide to Cloudflare covers the setup steps and settings that matter.
Layer 2: hide your origin server
A proxy only protects you if attackers cannot go around it. If your server’s real IP address is known, they can attack it directly.
- After moving behind a proxy, consider changing the server’s IP address, since the old one may already be in public DNS history
- Check that no DNS records (such as a mail or FTP subdomain) point straight to the web server’s IP
- Configure the server firewall to accept web traffic only from the proxy provider’s IP ranges
- Send email from a separate service so outgoing mail headers do not reveal the server IP
Layer 3: reduce work per request
Application level attacks succeed by making the server work hard. The less work each request causes, the more traffic you can absorb.
- Cache aggressively. Full page caching at the proxy or server means most requests never touch your application or database. See our guide to website caching.
- Serve static files from a CDN. Images, scripts and stylesheets should not hit your server on every request.
- Protect expensive pages. Search results, filtered listings, carts and logged in areas cannot be cached easily, so they need other controls.
- Block unused endpoints. If your CMS has remote access or API endpoints you do not use, disable or restrict them.
Layer 4: rate limiting and bot controls
Rate limiting caps how many requests a single visitor can make in a period. It is especially useful on:
- Login pages
- Contact and signup forms
- Search
- APIs (see API security for more on protecting endpoints)
Most proxy and firewall services offer rate limiting rules. Servers such as Nginx can also limit requests per IP address. Combine this with challenge pages during an attack, which ask suspicious visitors to pass a browser check before reaching the site, and with blocking countries you do not serve, if that makes sense for your business.
Layer 5: hosting that can cope
Ask your host what happens during an attack. Some hosts include network level filtering. Others will simply take your site offline to protect other customers. Shared hosting is the most exposed.
Questions to ask:
- Is DDoS filtering included, and at what level?
- What is your policy if my site is attacked?
- Can I restrict web traffic to my proxy provider’s IP ranges?
- How quickly does support respond to an incident?
Cloud and managed hosting with the ability to add capacity can help with smaller application level attacks, but scaling up to absorb an attack can also mean a much bigger bill. Filtering is usually cheaper than absorbing.
Layer 6: monitoring and a response plan
Set up uptime monitoring with alerts by email or text, so you know within minutes when the site stops responding. Watch your proxy service’s analytics for unusual traffic spikes.
Write a short plan before you need it:
- Confirm the problem: is it an attack, a traffic spike from a campaign, or a server fault?
- Turn on your proxy’s attack mode or stricter security level.
- Add rate limiting or block patterns you can see in the logs.
- Contact your host and your proxy provider’s support.
- Tell customers through social media or email if the outage is long.
- Do not pay extortion demands. Report them to the authorities.
- Afterward, review what happened and tighten settings.
Fold this into your wider website disaster recovery plan so the whole team knows where to look.
A quick checklist
- Site runs behind a proxy service with DDoS mitigation
- Origin server IP is hidden and locked to the proxy’s ranges
- Full page caching is enabled where possible
- Static files are served from a CDN
- Login, forms, search and APIs are rate limited
- Unused endpoints are disabled
- Host’s DDoS policy is known
- Uptime monitoring and alerts are set up
- A written response plan exists
FAQ
Can a small website really be targeted by DDoS?
Yes. Attacks are cheap to launch, and sites on shared servers can be affected by attacks on their neighbors.
Is free DDoS protection good enough?
For many small business sites, a free plan from a reputable proxy provider gives solid protection against common attacks. Paid plans add more control, faster support and features like advanced firewall rules.
Will DDoS protection slow my site down?
Usually the opposite. Most providers cache content close to visitors, which tends to make pages load faster.
What is the difference between a firewall and DDoS protection?
A web application firewall blocks malicious requests such as hacking attempts. DDoS protection deals with overwhelming volumes of traffic. Many services provide both.
Stay online when it counts
DDoS protection for a small business does not need a large budget. A good proxy service, a hidden origin server, sensible caching, rate limiting and a simple plan cover most of the risk. If you would like help building a site that stays fast and available, see Turn visitors into customers.
