DDoS protection

A DDoS attack, short for distributed denial of service, is an attempt to knock a website offline by sending it far more traffic than it can handle, all at once, from many sources at the same time. It is not about stealing anything or breaking in. It is about drowning the site under so many requests that real visitors cannot get through. DDoS protection is the system that catches that flood before it lands.

The “distributed” part is what makes it hard to stop with a simple rule. The requests come from thousands of different addresses at once, often devices that have themselves been compromised without their owners knowing, so there is no single source to just block. Stopping it takes a network large enough to absorb the volume and smart enough to tell attack traffic apart from real visitors in real time.

That is a job no small business, and honestly very few businesses of any size, can run themselves.

Why it matters to you

A site that goes down during a DDoS attack looks, to your customers, exactly like a site that is simply broken. They do not see the attack. They see a page that will not load, and they leave. For a business that depends on its site for enquiries or bookings, that downtime has a direct cost, and it can happen with no warning and no obvious cause on your end.

It is also not something you can defend against with a better web host in the traditional sense. A rented server has a fixed amount of capacity. A flood big enough will overwhelm it no matter how good the server is. Protection has to happen before the flood reaches the server at all.

How I set it up

Every site I build sits behind Cloudflare’s network, which puts this protection in place automatically as part of how traffic reaches the site. There is nothing separate to buy or configure. Attack traffic gets absorbed and filtered across Cloudflare’s global network, which is built to handle volumes far beyond what would take down a single server, before it ever reaches the site’s actual files.

This runs alongside a WAF, which handles a different kind of threat, requests that are trying to exploit something rather than just overwhelm it, and a bot check on forms, which stops automated abuse of the specific pages that accept input.

What it looks like in practice

For a business owner, this is a layer you should never notice, because noticing it means something already went wrong somewhere else. The site simply stays up. If you ever do look at Cloudflare’s dashboard, you may see a count of blocked requests over time, a number that ticks up quietly in the background while the site keeps loading normally for everyone it is meant to serve.