Originally published: July 27, 2021. Last updated: Oct 15, 2026.
A distributed denial of service (DDoS) attack tries to knock your website offline by flooding it with junk traffic from thousands of compromised devices. For a small business, even a short outage means lost orders, a damaged reputation, and customers who may never come back. The good news is that effective protection is no longer reserved for enterprises: the same cloud services that protect large companies now sell affordable plans built for smaller sites. This guide explains what has changed about DDoS attacks, seven practical defenses ordered by value, and what to do in the first thirty minutes of an attack.
If you are choosing infrastructure, pair this guide with the walkthrough on buying web hosting and the overview of website security attacks to watch out for. Hosting choice and DDoS readiness are two sides of the same decision.
Why DDoS Attacks Are Worse in 2026
The scale of DDoS attacks has exploded. Cloudflare reported mitigating 47.1 million DDoS attacks in 2025, a 121 percent increase over 2024, with the largest single attack peaking at 31.4 terabits per second in November 2025. Nearly nine in ten attacks now last under ten minutes: they are short, violent bursts designed to overwhelm before anyone can react manually. DNS floods have become the most common network-layer vector, and more than a third of attacks use multiple vectors at once. The practical lesson for owners: manual responses no longer work, and “just buy more bandwidth” was never a real defense against terabit-scale floods. Protection has to be automated, layered, and in place before the attack starts. You can follow the trend yourself in Cloudflare’s quarterly DDoS threat reports.
7 Ways to Mitigate a DDoS Attack
1. Use always-on, automated DDoS protection
This is the single highest-value step. Modern attacks finish in minutes, so protection that requires a human to notice the attack and flip a switch arrives too late. Always-on services from CDN and cloud providers detect and absorb attack traffic automatically, around the clock. For most small business sites, this comes bundled with a content delivery network plan at a modest monthly cost. Ask any provider: “Is mitigation always on, or does it require manual activation?” Only accept the first answer.
2. Put a CDN in front of your website
A content delivery network sits between attackers and your server, serving cached copies of your pages from servers around the world. It absorbs volumetric floods before they reach your origin, and it makes your site faster for legitimate visitors at the same time. For a brochure or e-commerce site, a CDN is the closest thing to a two-for-one deal in web security: performance plus protection. Enable it before you need it, because onboarding during an attack is painful.
3. Run redundant, anycast DNS
Attackers increasingly target DNS itself: if your domain stops resolving, your site is down even though your server is fine. Use a managed DNS provider with anycast routing, which spreads DNS queries across many locations so no single point can be flooded. Keep DNS with a provider separate from your web host when possible, so one provider’s outage does not take everything down.
4. Add a web application firewall and rate limiting
Network-layer floods get the headlines, but application-layer attacks that hammer your login page, search box, or checkout are just as effective at taking a small site down. A web application firewall (WAF) filters malicious HTTP requests, and rate limiting caps how many requests one visitor can make. Set sensible limits on expensive endpoints: login, search, contact forms, and checkout. Legitimate users never notice; bots hit a wall.
5. Harden the origin server
Your origin server should be hard to find and hard to exploit. Do not expose its real IP address publicly: route all traffic through your CDN or scrubbing provider. Keep every component patched, especially anything handling HTTP/2 traffic, and close UDP-based services you do not need, since those are the raw material for reflection attacks. This is also where the joint CISA, FBI, and MS-ISAC DDoS guidance points: know which of your assets are exposed to the internet, and shrink that surface.
6. Build redundant infrastructure
Redundancy does not stop an attack, but it stops an attack from becoming an outage. Spread critical services across providers or regions, use load balancers to shed failed nodes automatically, and make sure failover actually works by testing it. For a small business, “redundancy” can be as simple as a static backup page on a separate provider that your DNS can point to while the main site recovers.
7. Write and rehearse an incident response plan
Decide before the attack who does what: who calls the hosting provider, who posts the status update, who decides to fail over, and who talks to customers. Include your provider’s emergency contacts and your CDN dashboard credentials in the plan. Run a tabletop exercise once a year: walk through a simulated attack for an hour and fix whatever the drill exposes. Plans written during an outage are plans that fail.
What Does Protection Cost a Small Business?
Basic CDN plans with DDoS protection included start at low monthly prices, and several reputable providers offer capable free tiers for small sites. A WAF with rate limiting typically adds a modest monthly fee. Managed, always-on enterprise scrubbing runs higher and is usually overkill unless you are in a targeted industry such as gaming, crypto, or controversial media. Budget realistically: for most small business sites, a CDN plus WAF plus good DNS costs less per year than a single day of downtime during a busy season. Treat it as insurance you can measure.
Frequently Asked Questions
What is a DDoS attack in simple terms?
A distributed denial of service attack floods your website or server with traffic from many compromised devices at once, overwhelming it so real visitors cannot get through. The “distributed” part means the traffic comes from thousands of sources, which makes it hard to block by banning a single address.
Can a small business website really be targeted?
Yes. Many attacks are opportunistic or collateral: botnets sweep the internet probing for vulnerable services, and ransom-driven attacks deliberately target small businesses that cannot afford downtime. You do not need to be famous to be attacked; you only need to be reachable.
Is buying more bandwidth enough to stop a DDoS attack?
No. Modern attacks reach terabits per second, far beyond what any small business connection can absorb. Bandwidth helps with traffic spikes, but real DDoS defense comes from automated filtering upstream: CDN absorption, scrubbing, and rate limiting before traffic reaches your server.
What is the difference between a CDN, a WAF, and DDoS scrubbing?
A CDN distributes your content across many servers, absorbing floods and speeding up your site. A WAF filters malicious web requests aimed at your applications. Scrubbing centers are specialized facilities that clean attack traffic before passing legitimate traffic to you. For most small sites, a CDN with built-in WAF and DDoS protection covers all three needs.
How long do DDoS attacks usually last?
Most are short: nearly nine in ten attacks in 2025 lasted under ten minutes, according to Cloudflare’s data. That brevity is exactly why automated, always-on protection matters: by the time a person notices and reacts, the damage is done.
Should I report a DDoS attack to anyone?
Yes. Report it to your hosting provider and, for significant attacks, to law enforcement: the joint CISA, FBI, and MS-ISAC guidance encourages reporting to CISA, the FBI, or MS-ISAC. Keep traffic logs and timestamps, since they are the evidence investigators need.
