HostAtlas

How DDoS Attacks Work (and Why Small Sites Get Hit Too)

To defend against a DDoS attack, it helps to understand what’s actually happening. The good news: the concept is simple. The bad news: that simplicity is exactly why attacks are so cheap and common. Here’s the plain-English version.

The core idea: overwhelm, don’t break in

A DDoS attack doesn’t steal data or crack passwords. It just sends more traffic than your server can handle, until real visitors get a timeout instead of your site. Think of a shop doorway jammed by a crowd that has no intention of buying — genuine customers can’t get in.

The “distributed” part is the trick: the flood comes from many machines at once, often a botnet of thousands of infected computers, routers and IoT devices worldwide. That’s why you can’t just block one IP address — there are thousands, and they look like they’re everywhere.

Two flavors you’ll hear about

Volumetric (L3/L4) attacks — raw floods of packets meant to saturate your internet connection. Measured in gigabits per second. Your server never even gets a chance; the pipe is full.

Application-layer (L7) attacks — cleverer and cheaper. They send requests that look legitimate (loading a heavy search page, hitting login repeatedly) but pile up until your app or database collapses. These are harder to spot because each request seems real — which is where a WAF earns its keep.

Why small sites get hit

Three reasons it’s not just big targets:

  1. Attacks are cheap. Botnet time is rentable for pocket change; launching one takes no skill.
  2. They’re automated and broad. Scanners sweep the internet; your site can be collateral, not a chosen victim.
  3. Motives vary. Extortion (“pay or stay down”), a competitor’s sabotage, a disgruntled user, or plain vandalism.

You don’t need to be important to go offline.

What actually stops it

Since a volumetric flood saturates your connection before your server or firewall can act, the only real defense is filtering the traffic upstream — on a network big enough to absorb the flood and drop the junk before it reaches you. That’s what a DDoS protection service does: your traffic passes through its large anycast network first, attacks get scrubbed across many locations, and only clean requests reach your origin.

For European sites that want this under EU jurisdiction, WEDOS Protection provides L3–L7 filtering with a WAF on an EU anycast network:

Next steps

Frequently asked questions

What does DDoS stand for?

Distributed Denial of Service. 'Denial of service' means making a site unavailable; 'distributed' means the attack comes from many machines at once — often a botnet of thousands of infected devices — which is what makes it hard to block by IP.

Why would anyone attack my small website?

Often it's not personal. Attacks are cheap and automated — botnets scan and hit broadly, sometimes as extortion, sometimes as sabotage by a competitor, sometimes just as collateral. You don't need to be a big target to go down.

Can a firewall alone stop a DDoS?

No. A server firewall filters what reaches your app, but a volumetric flood saturates your bandwidth before the firewall matters. Stopping that requires filtering upstream, on a large network — which is what a DDoS protection service provides.

How long do DDoS attacks last?

Anywhere from a few minutes to days. Many are short bursts meant to test defenses or cause brief chaos; some are sustained extortion campaigns. Either way, every minute offline can cost a business real money.