Most DDoS attacks do not arrive because someone dislikes you. They arrive because your server is unprotected, and because testing an attack capability or renting one costs very little.
Short answer: what is a DDoS attack?
A DDoS (Distributed Denial of Service) attack sends fake traffic from many sources at once, exhausting server resources so that genuine visitors cannot reach the site. The aim is not to steal data but to stop the service. It should not be confused with being hacked: nobody enters the system; the doorway is simply blocked. Small sites are targeted too, because selection is usually based not on value but on lack of protection.
Attack types and which one hits you
| Type | How it works | Symptom | Who it affects |
|---|---|---|---|
| Volumetric | Saturates bandwidth | Site completely unreachable | Any site with finite bandwidth |
| Protocol | Exhausts the connection table | Connections fail, timeouts | Server/firewall layer |
| Application layer | Repeatedly calls expensive pages | Server up but site very slow | Dynamic sites, search/filter pages |
The third is hardest on small and medium businesses. Because traffic volume stays low it does not look like an attack; resources drain without a dramatic spike in the graphs. The team hunts for a performance problem when the cause is deliberate load.
How to tell you are under attack
- Traffic rose but conversions did not. If visits climb while orders and form submissions stay flat, the traffic may not be real.
- The origin makes no sense. Sudden concentration from countries irrelevant to your product.
- The same page is requested repeatedly, especially search, filter or cart pages that strain the server.
- Server resources are saturated while analytics look calm. Analytics tools do not count bots; the server still serves them — the gap between the two is a strong signal.
- Outages recur at set times. Automated attacks often run on regular intervals.
Protection layers: what stops what
- CDN / traffic distribution: the first line against volumetric attacks. Traffic is absorbed across a large network before reaching your server.
- WAF (web application firewall): effective against application-layer attacks; recognises and blocks malicious request patterns.
- Rate limiting: throttles excessive requests from one source. Simple, and among the most effective measures.
- Caching: turning expensive dynamic pages static lowers the cost of the attack.
- Resource elasticity: being able to add capacity during short attacks prevents total failure.
None of these suffices alone. Adding capacity by itself, for example, only makes you a more expensive target during an application-layer attack.
Response checklist during an attack
- Confirm first: is this an attack, or a genuine traffic surge? (A press mention produces the same symptom.)
- Examine your logs: IP distribution, requested pages, user-agent patterns.
- Enable rate limiting and filters, applying geographic restrictions if needed.
- Notify your provider. Network-level mitigations are outside your reach.
- Protect critical flows: configure so that payment and login are prioritised.
- Keep records. Post-attack analysis is the only way to prevent recurrence.
Netişlem expert view: "why would anyone target us?"
We hear this often, and the answer usually disappoints: in most attacks nobody is targeting you. Automated tools scan for unprotected systems, attack capacity is being tested, or cheap rented services strike targets at random.
Our second field observation: most businesses notice the attack only after the outage begins. Yet application-layer attacks usually announce themselves first as slowness. Caught at that stage, intervention is far cheaper; afterwards it becomes crisis management.
Third is the assumption that protection is expensive. For small and medium sites the three most effective measures — caching, rate limiting and a CDN — rarely require a large investment. The real cost accrues during the outage that happens without them.
Frequently asked questions
Is a DDoS the same as being hacked?
No. A DDoS halts the service without accessing data; being hacked involves unauthorised access. However, DDoS is sometimes used as a distraction, so monitoring security logs during an attack is advisable.
Does my hosting plan protect me?
Providers usually offer basic network-level protection, mostly against volumetric attacks. Application-layer attacks require additional layers such as a WAF and rate limiting. The scope of protection should be stated in your contract.
How long does an attack last?
From minutes to days. Short attacks are often exploratory and may recur, so treating a brief outage as "over" without taking measures is a risky choice.
Will changing my IP address solve it?
It can bring temporary relief but is not a lasting fix; a new address can be discovered quickly. The durable solution is a layer that filters traffic before it reaches your server.
Is this necessary for a small brochure site?
Risk is lower there, but caching and basic rate limiting are things you should implement for speed anyway — so they provide protection at no additional cost.
Conclusion
Defending against DDoS rests not on an expensive product but on a layered arrangement: caching, rate limiting, a CDN, and a WAF where needed. Those layers also make your site faster on ordinary days — so the investment produces value beyond attack scenarios.
If you would like us to assess your current protection level, get in touch. You can also review our DDoS protection, WAF and CDN solutions.