DDoS attacks: what they are and how to protect your business

A DDoS (distributed denial of service) attack overwhelms a website or service with fake traffic from thousands of sources at once, until real users can no longer get through. The goal is not to steal data but to take you offline: the site won't load, the app stops responding, sales stop. The scale is what makes it matter. Cloudflare alone blocked 7.3 million DDoS attacks in the second quarter of 2025, and the 27.8 million it stopped in the first half of the year already amounted to 130% of everything it saw in all of 2024. The short version: DDoS is no longer a big-company problem. It has become cheap, automated and aimed at everyone. The good news is that with the right setup, most attacks can be absorbed before you even notice them.

How a DDoS attack actually works

A plain denial-of-service (DoS) attack comes from a single source and is easy to stop: you block that IP address and it's over. The extra "D" in DDoS stands for distributed, and that is the whole difference. The attacker uses a botnet, a network of thousands of devices hijacked without their owners' knowledge, often cameras, home routers, smart appliances and poorly secured servers. When they all send requests to the same target at once, each individual request looks almost identical to one from a real visitor. That is the hard part: telling the bad request from the good one becomes very difficult under the sheer volume of the attack.

Three kinds of attack: volume, protocol, application

DDoS attacks work at roughly three layers. Volumetric attacks are the best known: they fill the target's internet pipe with a huge amount of data, measured in terabits per second (Tbps). Protocol attacks go after the resources of the server and firewall rather than the bandwidth; the classic example is the SYN flood, which fills the connection table with half-open connections that never complete. Application-layer (L7) attacks are the sneakiest: they repeatedly call a small number of expensive requests, say a search query or a login page, while looking like a genuine browser. In Cloudflare's Q2 2025 data, the top network-layer vectors were DNS floods (about 33%) and SYN floods (27%). Most volumetric attacks are magnified with an "amplification" trick: the attacker sends a small request to an open server while forging the source so it looks like your address, and that server fires a far larger reply back at you.

How big can it get

The records break almost every year. In Q2 2025 Cloudflare stopped the largest attack seen up to that point, 7.3 Tbps. By September the record was 11.5 Tbps, and by November it reached 31.4 Tbps. The detail that matters is duration: most of these giant attacks last seconds, not minutes, and the 31.4 Tbps flood was over in well under a minute. That has a practical consequence. You cannot "absorb" that kind of traffic on your own server or office connection; the pipe is already choked. This is why serious DDoS protection does not happen on a single server but on a network that spreads the traffic across the world.

Two real examples

Two incidents make it concrete. On 28 February 2018 GitHub was hit by the largest attack recorded at the time, 1.35 Tbps. What made it unusual is that there was no botnet behind it: the attackers used misconfigured, internet-exposed "memcached" servers as amplifiers. GitHub rerouted its traffic to a scrubbing service and the attack died down after about 20 minutes. The second example is the 2016 attack on Dyn: the Mirai IoT botnet did not target a specific site but Dyn, the DNS provider that many large sites relied on. Twitter, Reddit, Spotify and Netflix were unreachable for hours, even though their own servers were running fine. The lesson is blunt: an attacker does not need to hit you to take you down, only a service you depend on.

Ransom DDoS: pay or it keeps going

DDoS also comes as a threat. In a ransom DDoS the attacker runs a short "demo" attack, then leaves a message saying it continues unless you pay. It is a cousin of the ransomware that encrypts your files, except here they hold your availability hostage rather than your data. Cloudflare's data shows ransom DDoS threats rose 68% in Q2 2025 over the previous quarter. Paying is not a fix: it marks you as a softer target next time, and there is no guarantee the attack actually stops.

How to protect your business

The core principle is to stop the attack away from your own connection, before it reaches you. In practice that means a few layers. First, put your traffic behind a large, distributed network, a CDN or a dedicated DDoS protection service; Cloudflare, Akamai, AWS Shield, Azure DDoS Protection and Google Cloud Armor all do this, soaking up massive traffic by spreading it across hundreds of data centers. Second, keep your real server's IP address hidden; if it leaks, an attacker can bypass the protection and hit the server directly. Third, add rate limiting and a web application firewall for application-layer attacks, because L7 works through cleverness rather than volume. Fourth, host your DNS with a resilient provider, because as Dyn showed, DNS is a favourite target. And there is your own side of the bargain: close any open DNS, NTP or memcached services so your servers are not turned into amplifiers in someone else's attack.

Prepare before the attack, not during it

The most expensive mistake is thinking about DDoS protection only after an attack starts. Trying to buy a service mid-attack usually means waiting for a DNS change to propagate, which takes hours. Instead, write a plan on a calm day: who provides the protection, who steps in during an attack, what your provider's emergency line is, and which traffic sits behind "always-on" protection. For a small business the smartest route is usually to put the site behind an always-on DDoS protection service from the start, so there is nothing extra to do when an attack arrives.

Protecting against DDoS is not about buying a box; it is about designing where your traffic flows and who does what the moment an attack lands. At Wedevit we map your internet-facing services, check whether your real server addresses have leaked, set up a DDoS protection and DNS architecture that fits you, and configure rate limiting and firewall rules for L7 attacks. It works best as the availability side of a broader zero trust approach, not a fix on its own. The concrete first step: if an attack hit today, is there a layer in front of your traffic to stop it, or would it reach your server directly? Put that answer in writing.