Active incident or hacked WordPress? Ransomware Hacked WordPress 423-888-0252 · 828-484-1257
Diversified Tech Solutions Diversified Tech Solutions Technology · Security · Compliance

What Is a DDoS Attack?

Definition

A distributed denial-of-service (DDoS) attack tries to knock a website, server, or network offline by flooding it with more traffic or requests than it can handle. "Distributed" means the flood comes from many machines at once, usually a botnet of compromised computers and devices, which makes it hard to block at the source.

How It Works

CISA, the FBI, and MS-ISAC group DDoS techniques into three types:

  • Volumetric attacks send a "massive volume of traffic" to saturate the network connection, so legitimate requests cannot get through.
  • Protocol attacks "exploit vulnerabilities in network protocols or services," exhausting resources on firewalls, load balancers, or servers.
  • Application layer attacks target the website or app itself, sending requests that look normal but are expensive to answer, such as searches, logins, or uncached pages. On WordPress, a modest flood of these can overwhelm PHP and the database.

Motives range from extortion ("pay or stay offline") to protest, competition, or covering another attack while defenders are distracted.

Defense is mostly about capacity and filtering upstream. A small server cannot out-muscle a botnet, so the usual answer is a CDN or DDoS protection service that absorbs traffic across a large network and filters bad requests before they reach the origin. Hiding the origin server's real IP address keeps attackers from going around that protection. Caching reduces how much work each request causes. CISA also recommends a plan made before an attack: who to call at the hosting provider and protection service, and how to tell customers.

Real-World Example

In October 2023, CISA warned of an HTTP/2 flaw called "Rapid Reset" (CVE-2023-44487) that had been "exploited in the wild in August 2023 through October 2023." Google said it mitigated an attack peaking above 398 million requests per second, about 7½ times larger than the record attack it had blocked the year before. Cloudflare reported a peak just above 201 million requests per second and noted the attacker generated it "with a botnet of merely 20,000 machines." Fixes came as updates to web servers and proxies.

Why It Matters for a Small Business

A small business is rarely the target of a record-breaking attack, but it does not take one. A few thousand requests per second against uncached WordPress pages can take a typical hosting plan offline, and shared hosting means a neighbor's attack can take you down too. Downtime means lost sales and missed leads, and an outage can be used as a distraction while attackers try something else. Protection set up in advance costs far less than emergency help arranged while the site is down and customers are calling.

How to Spot It / How DTS Handles It

Warning signs: the site slow or unreachable while the server shows high load, sudden traffic spikes from many countries, hosting provider warnings about resource limits, extortion emails threatening an attack, and an origin IP address that is publicly known.

DTS can help with putting a website behind a CDN with DDoS protection and rate limiting, hiding the origin IP address, tuning caching, and writing down who to call at the host and providers. See our WordPress maintenance service for websites, or our managed IT service for office networks.

Related Terms

  • CDN: the network that absorbs most DDoS traffic.
  • Origin IP exposure: how attackers bypass DDoS protection.
  • Web application firewall (WAF): filtering application layer floods.
  • Rate limiting: capping requests per visitor.
  • Botnet: the machines behind the flood.
  • Uptime monitoring: knowing quickly when the site goes down.
  • Business continuity plan: staying in business during an outage.

Sources

  • CISA, FBI, and MS-ISAC, Understanding and Responding to Distributed Denial-of-Service Attacks (version 2.0, March 2024): https://www.cisa.gov/resources-tools/resources/understanding-and-responding-distributed-denial-service-attacks
  • CISA, HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487 (October 10, 2023): https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
  • Google Cloud, Google Cloud mitigated largest DDoS attack, peaking above 398 million rps (October 10, 2023): https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps
  • Cloudflare, HTTP/2 Rapid Reset: deconstructing the record-breaking attack (October 10, 2023): https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/

Last updated October 14, 2026.