A denial-of-service attack tries to make a website or online service unusable by flooding it with more traffic than it can handle. In a distributed denial-of-service attack, or DDoS, the traffic comes from thousands of devices at once. That makes it much harder to block than traffic from a single source.
Where the traffic comes from
Most DDoS traffic comes from a botnet: a large group of hijacked devices that an attacker controls remotely. These are often everyday things with weak security, such as home routers, security cameras and other connected devices that still use their default password or never get updates. Their owners usually have no idea. Attackers also rent cloud servers, and "booter" or "stresser" services sell attacks to anyone who pays. Running or buying such an attack is a crime in most countries.
The reasons vary: extortion ("pay or we keep your site down"), protest, revenge, rivalry, or a distraction while the attacker tries something else.
The three main types
The US Cybersecurity and Infrastructure Security Agency (CISA) groups attacks into three families. CISA took over the work of the former US-CERT, so older links to US-CERT pages now lead to cisa.gov.
- Volumetric attacks fill the connection with junk traffic, so real visitors cannot get through. They are measured by the amount of data per second.
- Protocol attacks abuse how network connections are set up. A SYN flood, for example, opens huge numbers of half-finished connections until the server or firewall runs out of room.
- Application attacks send requests that look like real visitors, such as repeated searches or page loads, aimed at the parts of a site that need the most work. They need less traffic and are harder to tell apart from real users.
How websites defend themselves
No single tool stops every attack. Sites stack several defences:
- A content delivery network or DDoS protection service. These run very large networks spread across many countries. Visitors connect to the nearest point, so attack traffic is spread out and filtered far from the real server.
- A hidden origin. The server that runs the site accepts traffic only from the protection network, so attackers cannot go around it.
- Rate limits. Each address can make only a set number of requests in a given time, on sign-in pages and searches especially.
- Challenges and a web application firewall. Suspicious traffic is asked to prove it is a real browser, and known attack patterns are blocked.
- Caching and spare capacity. Pages served from a cache cost almost nothing, so the site can absorb more before it slows down.
- A plan. Know who to call at your host, how to turn on stricter settings, and where you will post updates if the site is down.
What to do during an attack
If you run a site, first confirm it is an attack. A sudden spike can also come from a mention in the news or a software fault. Your host or protection provider can usually tell from the traffic pattern. If it is an attack, ask them to step up filtering and keep a record of times, traffic graphs and any messages from the attacker.
Do not pay an extortion demand. Report it to the police and to your national cybersecurity team: in the EU, each country has a national CSIRT listed by ENISA, the EU agency for cybersecurity. CISA's guide Understanding and Responding to Distributed Denial-of-Service Attacks, written with the FBI and MS-ISAC, is a good checklist for preparing in advance. The UK NCSC also publishes denial-of-service guidance.
If you are a visitor and a site is down, there is little you can do except wait and follow the company's official channels. Be careful with messages that appear during an outage and offer a fix, a refund or a "new site". Scammers use outages too.
Keep your own devices out of botnets
You can help by making sure your devices are not part of the problem. Keep your router and connected devices updated, change any default passwords, switch off remote access you do not use, and replace devices that no longer get security updates.
Common questions
- Is a DDoS attack a hack?
- Not in the usual sense. It overloads a service without breaking into it. Some attackers use it as cover for a break-in, so check your other systems afterwards.
- Does a DDoS attack steal data?
- On its own, no. The goal is to make the service unavailable.
- How long does an attack last?
- Many last minutes or hours. Some return in waves over days. Good protection keeps the site up through most of them.
- Can a home connection be attacked?
- Yes, it happens to some online gamers. Your internet provider can help, and restarting the router may give you a new address.
Prepare the plan while the site is up. It is much harder to write one while it is down.