A website may go offline even when its server has not been hacked and no information has been stolen. Sometimes the problem is simply that the system is being flooded with more traffic or requests than it can handle.
When that traffic comes from many devices working together, the incident is known as a distributed denial-of-service attack, or DDoS attack.
DDoS attacks target availability. Their main purpose is to prevent legitimate users from reaching a website, application, network, game server, or online service. The disruption may last for minutes, hours, or longer and can create financial, operational, and reputational damage.
What Is a DDoS Attack?
A DDoS attack is a cyberattack in which multiple devices send large amounts of traffic or requests to the same target.
The target’s bandwidth, connection capacity, processor, memory, or application resources become exhausted. Legitimate users then experience:
- Slow loading
- Connection errors
- Timeouts
- Failed transactions
- Complete service outages
CISA defines a denial-of-service attack as an event that prevents legitimate users from accessing systems, devices, or network resources. CISA
The word “distributed” means the attack originates from many systems rather than one device.
How Does a DDoS Attack Work?
Most large DDoS attacks use a botnet—a network of compromised computers, routers, cameras, servers, or other internet-connected devices.
The process usually works like this:
- An attacker infects or gains control of many devices
- The devices connect to command-and-control infrastructure
- The attacker selects a target
- Every compromised device sends traffic toward that target
- The target struggles to distinguish attack traffic from legitimate users
- Available resources become exhausted
- The service slows down or becomes unavailable
Because traffic arrives from many IP addresses, simply blocking one source does not stop the attack.
Some attacks also use reflection and amplification. Instead of sending traffic directly, the attacker causes third-party servers to send much larger responses to the victim.
DoS vs. DDoS Attack
A denial-of-service attack, or DoS attack, usually comes from one source.
A distributed denial-of-service attack comes from many systems at the same time.
A DDoS attack is generally:
- More powerful
- Harder to trace
- More difficult to block
- Distributed across many locations
- Capable of generating far more traffic
Both attacks aim to make a system unavailable.
Common Types of DDoS Attacks
DDoS attacks are usually divided into three broad categories:
- Volumetric attacks
- Protocol attacks
- Application-layer attacks
Microsoft similarly groups DDoS attacks into volumetric, protocol, and resource or application-layer categories. Microsoft Security
Volumetric DDoS Attacks
A volumetric attack attempts to consume all available bandwidth between the target and the internet.
The attacker sends an enormous amount of traffic, often measured in gigabits or terabits per second.
UDP Flood
A UDP flood sends large numbers of User Datagram Protocol packets to ports on the target.
The system checks for applications associated with those packets and may send responses. Processing this traffic consumes network and server resources.
ICMP Flood
An ICMP flood, sometimes called a ping flood, overwhelms a target with internet-control messages.
The target uses resources processing and responding to the requests.
DNS Amplification Attack
A DNS amplification attack sends small requests to publicly accessible DNS servers while using the victim’s IP address as the apparent source.
The DNS servers send much larger responses to the victim, multiplying the attacker’s traffic.
CISA warns that misconfigured DNS servers can be abused to participate in amplification attacks. CISA
NTP Amplification Attack
This technique abuses exposed Network Time Protocol services.
A small forged request can produce a larger response directed toward the target.
Protocol DDoS Attacks
A protocol attack exploits the way network devices and servers handle connections.
Rather than consuming only bandwidth, it may exhaust firewalls, load balancers, connection tables, and server resources.
SYN Flood
A SYN flood abuses the TCP connection process.
The attacker sends large numbers of connection requests but does not complete the handshake. The server keeps many half-open connections and eventually runs out of capacity for legitimate users.
ACK Flood
An ACK flood sends large volumes of acknowledgement packets.
Firewalls and other network devices must inspect the traffic to determine whether each packet belongs to a real connection.
Fragmentation Attack
A fragmentation attack sends incomplete, overlapping, or malformed packet fragments.
The target consumes resources attempting to reassemble or process them.
Ping of Death
A ping-of-death attack involves malformed or oversized packets that may crash or disrupt vulnerable systems.
Modern systems are generally protected against classic versions, but malformed-packet attacks still exist in different forms.
Application-Layer DDoS Attacks
An application-layer attack targets the part of a service that processes web pages, searches, logins, database queries, or other user actions.
These attacks can be difficult to detect because each request may look legitimate.
HTTP Flood
An HTTP flood sends large numbers of web requests to a server.
The requests may repeatedly load pages, submit searches, access files, or perform expensive application operations.
Login Flood
A login flood repeatedly targets authentication pages.
The application must validate credentials, create sessions, query databases, and apply security checks, consuming resources.
API Flood
An API flood targets application programming interfaces.
Attackers may choose endpoints that require significant processing, database work, or communication with other services.
Low-and-Slow Attack
A low-and-slow attack uses relatively small amounts of traffic but keeps connections open or sends requests extremely slowly.
Because the activity resembles ordinary users with poor connections, it can be difficult to separate from legitimate traffic.
Cache-Busting Attack
A cache-busting attack adds changing query values to requests so the content-delivery network or caching layer cannot reuse stored responses.
Every request is forced back to the origin server, increasing the load.
Multi-Vector DDoS Attacks
A multi-vector attack combines several techniques.
An attacker may begin with a UDP flood, switch to a SYN flood, and then target the application with HTTP requests.
Changing methods can make incident response more difficult and reveal weaknesses at different layers.
Reflection and Amplification Attacks
A reflection attack hides the attacker’s source by sending requests to third-party systems with the victim’s IP address.
Those systems respond to the victim.
An amplification attack also makes each response substantially larger than the original request.
This allows an attacker with limited bandwidth to generate far more traffic against the target.
What Is a Ransom DDoS Attack?
In a ransom DDoS attack, criminals threaten to disrupt a service unless the organization pays them.
The attacker may launch a short demonstration attack to prove the threat is credible.
Paying does not guarantee that the attack will stop or that the criminals will not return. Organizations should involve their hosting provider, DDoS protection service, security team, legal counsel, insurer, and appropriate authorities.
Why Do Attackers Launch DDoS Attacks?
Possible motivations include:
- Extortion
- Political protest
- Competition between online services
- Revenge
- Distraction from another intrusion
- Cyberwarfare
- Ideological campaigns
- Gaming disputes
- Testing attack services
- Creating reputational damage
A DDoS attack can also distract security staff while attackers attempt account takeover, data theft, fraud, or network intrusion elsewhere.
Common DDoS Targets
DDoS attacks can affect:
- Business websites
- Online stores
- Banks and payment services
- Government websites
- Gaming servers
- Streaming platforms
- News organizations
- Telecommunications providers
- Cloud applications
- DNS providers
- Educational institutions
- Healthcare services
- Cryptocurrency platforms
- APIs and mobile backends
Small organizations are not automatically safe. An attacker can rent criminal DDoS infrastructure and target a service without owning a large network.
Warning Signs of a DDoS Attack
Possible warning signs include:
- Sudden, unexplained traffic spikes
- Website becoming unusually slow
- Large numbers of requests from unusual locations
- Many requests for one page or endpoint
- Rapid increase in failed connections
- Bandwidth reaching capacity
- Firewall or load-balancer exhaustion
- High processor or memory usage
- Similar requests from many IP addresses
- Unusually high numbers of incomplete connections
- Customers reporting timeouts
- DNS failures
- Services becoming unavailable at regular intervals
- Large traffic volumes using one protocol
- Increased cloud or bandwidth costs
A legitimate event, promotion, or viral post can create similar traffic. Accurate detection requires comparing current behavior with normal patterns.
Does a DDoS Attack Mean the Website Was Hacked?
Not necessarily.
A DDoS attack mainly affects availability. It does not automatically mean that an attacker accessed databases, changed files, or stole information.
However, security teams should still investigate because:
- The attack may hide another intrusion
- Misconfigurations may be exposed
- Logs may show suspicious activity
- Attackers may target login or API endpoints
- Other vulnerabilities may be exploited simultaneously
How to Respond to a DDoS Attack
Confirm the Incident
Check monitoring systems, server health, bandwidth use, application logs, DNS status, and provider alerts.
Rule out ordinary outages, failed updates, configuration errors, and legitimate traffic spikes.
Activate the Response Plan
Organizations should have a documented DDoS response process containing:
- Emergency contacts
- Technical responsibilities
- Provider details
- Escalation thresholds
- Communication plans
- Alternative service arrangements
- Evidence-preservation procedures
CISA provides a guide specifically for organizations responding to distributed denial-of-service attacks. CISA
Contact the Hosting Provider
The hosting company, cloud provider, content-delivery network, or internet service provider may have visibility and filtering capabilities that the organization does not possess.
Contact them as early as possible.
Enable DDoS Mitigation
Route traffic through an appropriate mitigation service.
A mitigation provider can inspect traffic, discard malicious requests, and forward legitimate connections to the application.
Protect the Origin Server
Prevent attackers from bypassing the protection layer and sending traffic directly to the origin.
Restrict direct access, protect origin IP addresses, and allow traffic only from approved proxy or content-delivery infrastructure when appropriate.
Apply Rate Limits
Rate limiting restricts the number of requests accepted from a client or session.
It can reduce some application-layer attacks but must be configured carefully to avoid blocking legitimate users.
Use a Web Application Firewall
A web application firewall, or WAF, can block suspicious application requests, abusive automation, and known attack patterns.
A WAF does not replace network-layer DDoS protection.
Scale Resources Carefully
Cloud scaling may help absorb legitimate traffic and smaller attacks.
Scaling alone is not a complete defense. A large attack can still exceed limits and generate significant costs.
Preserve Logs
Save traffic samples, timestamps, source information, affected endpoints, provider communications, and mitigation actions.
This information may support later investigation and reporting.
Communicate With Users
If service is unavailable, publish clear updates through a separate status page, social-media account, email list, or other independent channel.
Avoid making unsupported claims about data theft before the investigation is complete.
How DDoS Mitigation Works
Cloud-based DDoS mitigation commonly follows four stages:
Detection
Traffic-monitoring systems identify unusual patterns, volumes, or request behavior.
Diversion
Traffic is redirected through a large mitigation network or scrubbing center.
Filtering
The service separates malicious traffic from legitimate users.
Forwarding
Clean traffic is sent to the protected application or network.
Cloudflare describes DDoS mitigation as protecting a targeted server or network through specialized network equipment or cloud-based protection. Cloudflare
How to Prevent DDoS Attacks
No organization can prevent criminals from sending traffic, but it can reduce the likelihood that the attack causes an outage.
Use Always-On DDoS Protection
Always-on protection continuously analyzes traffic instead of waiting for a manual response.
This reduces the time between detection and mitigation.
Use a Content-Delivery Network
A content-delivery network, or CDN, distributes content across many locations.
Its larger network capacity and caching can absorb or reduce some attacks before they reach the origin.
Build Redundant Infrastructure
Distribute services across multiple servers, regions, and network providers.
Avoid relying on one server, data center, or DNS provider for every critical function.
Monitor Traffic Continuously
Create a baseline for normal bandwidth, requests, countries, protocols, pages, and application behavior.
Detection is faster when monitoring systems understand what normal activity looks like.
Apply Rate Limiting
Set appropriate limits for:
- Login attempts
- API calls
- Search requests
- Expensive database operations
- Password resets
- File downloads
Different endpoints may require different policies.
Protect DNS
Use a resilient DNS provider with distributed infrastructure and DDoS protection.
DNS failure can make every service appear offline even when the application servers remain available.
Secure the Origin IP Address
Avoid exposing the origin server’s address through old DNS records, email headers, direct links, or unnecessary services.
Restrict the origin to approved upstream networks where possible.
Use Network Segmentation
Separate public services from internal systems.
An attack against the website should not automatically disrupt email, administration, databases, and internal operations.
Patch Systems
Install updates for servers, firewalls, routers, load balancers, applications, and management tools.
Updates help prevent attackers from exploiting vulnerabilities during or alongside a DDoS attack.
Optimize Applications
Cache content, improve database queries, set connection timeouts, and prevent unauthenticated users from triggering unnecessarily expensive operations.
Efficient applications are more resilient under both legitimate load and attack traffic.
Test the Response Plan
Perform authorized exercises with the hosting and mitigation providers.
Confirm that contact details, routing changes, alerts, status pages, and escalation procedures actually work.
Can Antivirus Software Stop a DDoS Attack?
Antivirus software can prevent a device from becoming part of a botnet, but it cannot normally protect a public website from a large incoming DDoS attack.
Website protection requires network monitoring, filtering, content delivery, scalable infrastructure, and specialized mitigation.
Can a VPN Stop a DDoS Attack?
A consumer VPN may hide an individual user’s IP address in some situations, but it is not a complete DDoS defense.
If the VPN server or exposed service is targeted, the attack can still cause disruption. Businesses need protection designed for their infrastructure and applications.
How Long Does a DDoS Attack Last?
A DDoS attack may last seconds, minutes, hours, or days.
Attackers can also stop and restart repeatedly. Effective monitoring should continue after traffic returns to normal.
Is a DDoS Attack Illegal?
Launching a DDoS attack against a system without authorization is illegal in many jurisdictions.
Calling an attack a test, protest, prank, or stress test does not make it authorized. Legitimate load testing must be approved by the owner and coordinated with relevant providers.
Can a Small Website Be DDoS Attacked?
Yes. Small websites may have less capacity and fewer protection services, making them easier to disrupt.
Using a reputable hosting provider, CDN, secure DNS service, monitoring, and an incident plan can significantly improve resilience.
