A distributed denial-of-service attack overwhelms a website or service with traffic. The practical response combines upstream filtering, resilient hosting, monitoring, and a clear escalation path.
Key takeaways
What to know before you act
- Most small organizations cannot absorb a large DDoS attack at their own server; filtering has to happen upstream at a CDN, WAF, or hosting provider.
- Preparation—DNS access, provider contacts, alert thresholds, and a customer communication plan—shortens disruption more than improvisation during an attack.
- Not every outage is a DDoS; confirm the cause before making changes that could make recovery harder.
Why it matters
What business leaders should understand
Even when attackers do not steal data, an unavailable website can interrupt sales, client communication, and trust. Preparation matters because filtering is most effective before traffic reaches an overloaded origin server.
The right response should reflect your environment, data, vendors, risk, and operational priorities. Use this guide as a practical starting point, then validate important decisions with the people responsible for your technology, cybersecurity, legal obligations, and insurance coverage.
Learn how Meta IT Pro can help with cybersecurity services and security awareness training.
Related reading: How to secure your business website and Common cyberattacks against small businesses.
How a DDoS attack affects a business website
A distributed denial-of-service attack sends more traffic or requests than a website, application, or network connection can handle. Some attacks flood bandwidth; others send a smaller number of expensive requests, such as searches or login attempts, that exhaust the application or database.
The business impact is usually lost availability: customers cannot reach the site, place orders, book appointments, or use a portal. A DDoS can also be used as a distraction, so watch for other suspicious activity while responding.
Prepare before traffic arrives
The most effective protection sits between the internet and your origin server. A reputable content delivery network or web application firewall can absorb volume, block known-bad patterns, and apply rate limits. Hiding the origin server's address and allowing traffic only from the protection provider prevents attackers from bypassing it.
Write down who controls DNS, hosting, the registrar, and the CDN, and confirm that more than one trusted person can sign in to each. During an attack, time lost locating credentials or a support number directly extends the outage.
- Enable rate limiting on login, search, form, and API endpoints.
- Restrict the origin server to traffic from the protection provider.
- Set alerts on traffic volume, error rates, and response times.
- Prepare a status message and alternate contact method for customers.
What to do during an attack
Confirm the symptoms with monitoring and hosting data, then contact the hosting or protection provider with timestamps and examples. Enable stricter filtering modes if the provider offers them, and avoid ad-hoc changes to DNS or server configuration without coordination.
Afterward, review what was targeted, how quickly the issue was detected, which controls helped, and what should change. Record the timeline in case an insurer, customer, or law-enforcement report is needed.
Practical action plan
Steps your business can take
Place public services behind a reputable CDN and web application firewall.
Enable rate limiting, bot controls, alerts, and hosting-provider DDoS protection.
Document DNS, hosting, registrar, and vendor escalation contacts.
Test how the business communicates with customers when the primary website is unavailable.
Recommended next steps
Continue from this article.
These pages expand the specific risks and decisions covered in this guide. Use them to move from general understanding to the service, tool, or related topic that best matches your next question.
Related guide
How to secure your business website
Cover updates, administrator access, backups, and monitoring alongside DDoS protection.
Explore nextService
Network security services
Design firewall, filtering, monitoring, and remote-access protections around business systems.
Explore nextService
Incident response services
Coordinate triage, containment, and recovery when an attack disrupts operations.
Explore nextRelated guide
Common cyberattacks against small businesses
See how DDoS fits among the attacks small organizations face most often.
Explore nextWarning signs
Do not ignore these indicators
- A sudden traffic surge from many networks or countries
- Repeated timeouts while the origin server shows resource exhaustion
- Hosting alerts tied to unusual requests or bandwidth
Frequently asked questions
Common questions, answered.
Can a small business stop a DDoS attack on its own server?
Usually not. Large attacks must be filtered upstream by a CDN, web application firewall, or hosting provider before traffic reaches your server.
How do I know if my website outage is a DDoS attack?
Check hosting and monitoring data for sudden traffic spikes from many sources, request floods, or resource exhaustion. Many outages have other causes, so confirm before making changes.
What should be in a DDoS response plan?
Provider and DNS contacts, who can change protection settings, how to enable stricter filtering, and how you will communicate with customers while the site is unavailable.
How Meta IT Pro can help
Related services and practical next steps
Explore the services connected to this topic. These links provide more detail about scope, safeguards, support, and how to start a conversation with our team.
Authoritative references
Sources and further reading
These primary sources support the guidance in this article and provide additional technical or consumer information.
Cybersecurity and Infrastructure Security Agency
Understanding Denial-of-Service Attacks
CISA's overview of denial-of-service and distributed denial-of-service attacks and how to respond.
National Institute of Standards and Technology
NIST SP 800-61 Rev. 3: Incident Response Recommendations
Current NIST guidance for integrating incident response into cybersecurity risk management.
National Institute of Standards and Technology
The NIST Cybersecurity Framework (CSF) 2.0
A flexible framework for governing, identifying, protecting, detecting, responding to, and recovering from cybersecurity risk.
Need help with your IT solution?
Get practical guidance from a local IT and cybersecurity team.
Meta IT Pro helps Massachusetts and Rhode Island businesses improve support, security, Microsoft 365, Google Workspace, networks, backup, recovery, and compliance readiness. Tell us what is not working - or what you want to improve - and we will help identify a sensible next step.