Guide · Security
DDoS protection for small and medium businesses
DDoS attacks — floods of traffic that make a website unavailable — are not only a problem for banks and large media. Online stores during sales, booking sites in high season, businesses in competitive niches and organisations involved in public debates are targeted too, often with cheap attacks bought as a service. The good news: basic protection is affordable and much easier to set up before an attack than during one.
[ 01 ]
In short
In short
- 01
Put the website behind a provider with DDoS mitigation, usually combined with a CDN.
- 02
Hide the origin server's real IP address and accept traffic only from the protection provider.
- 03
Add rate limits to logins, forms, search and APIs.
- 04
Cache what can be cached, so the server handles only necessary work.
- 05
Prepare a simple plan: who is alerted, which emergency settings to enable, how to inform customers.
[ 02 ]
Guide
Realistic risks
- Volumetric floods that saturate the connection — handled by providers with large networks.
- Application-layer attacks that send many expensive requests — searches, logins, heavy pages — and can take down a small server with modest traffic.
- Bots scraping, brute-forcing passwords or spamming forms, which are not DDoS in the strict sense but have similar effects.
Affordable protection layers
CDN and DDoS mitigation
Routing traffic through a CDN or security provider with DDoS protection absorbs volumetric attacks and filters obvious malicious traffic. Many providers offer free or low-cost plans suitable for small sites. See CDN.
Web application firewall
A WAF blocks common attack patterns and allows custom rules for your site's weak points.
Hidden origin
If attackers know your server's real IP address, they can bypass the protection. Keep the origin IP out of DNS records, old subdomains, email headers and public code, and configure the server to accept web traffic only from the provider.
Rate limiting and bot challenges
Limit how often a single source can log in, submit forms or call APIs. Use challenges for suspicious traffic, while allowing legitimate crawlers.
Caching
Serve static pages and files from cache wherever possible. The less work each request requires from the server, the more traffic it can survive.
Preparation
- Know who is alerted and how. See 24/7 monitoring.
- Know which emergency settings exist: stricter challenges, blocking by country or pattern, "under attack" modes.
- Keep contacts for hosting and protection providers at hand.
- Prepare a status message and alternative channels to reach customers (social media, messengers).
During an attack
- Confirm it is an attack, not a traffic spike from a campaign or a technical fault.
- Enable stricter protection settings.
- Identify patterns — paths, sources, user agents — and add rules.
- Keep customers informed through other channels if the site is affected.
- After the attack, review logs and strengthen weak points.
[ 03 ]
FAQ
Frequently asked questions
Can a small business afford DDoS protection?
Basic protection through a CDN provider is often inexpensive or free. More advanced protection and support cost more and suit higher-risk businesses.
Will protection block real customers?
Poorly tuned rules can. Monitor blocked requests after changes and relax rules that affect legitimate users, such as mobile networks sharing addresses.
Should we pay attackers who demand money?
Law enforcement and security experts generally advise against paying. Invest in protection and report extortion to the authorities.