A website can be perfectly built, well-optimised, and running on excellent infrastructure, and still become completely unreachable. A Distributed Denial of Service attack does not need to find a vulnerability in your code, steal your credentials, or breach your database. It simply needs to send more traffic than your infrastructure can handle, until legitimate users cannot get through.
DDoS attacks are among the most common threats to website availability. Understanding what they are, how they work, and why infrastructure decisions determine how well you survive one is essential for anyone responsible for keeping a website online.
📖 How does server load behave during a DDoS attack?
A DDoS attack is an extreme form of server load, but the mechanics are the same. Read What Is Server Load and Why Websites Slow Down, a complete breakdown of how resource exhaustion causes performance degradation and what the warning signs look like before a server fails.
What a DDoS Attack Is
A Distributed Denial of Service attack is an attempt to make a website or online service unavailable by overwhelming it with traffic from multiple sources simultaneously. The “distributed” part is what separates it from a basic denial of service attack: rather than one machine sending requests to one target, hundreds or thousands of machines send requests at the same time.
The machines doing the attacking are usually not owned by the attacker. Most large-scale DDoS attacks use botnets, networks of devices infected with malware that allows an attacker to control them remotely. These devices may be servers, home routers, IoT devices, or compromised personal computers. Their owners typically have no idea their devices are participating in an attack.
The goal of a DDoS attack is not to steal data or gain access to systems. It is to exhaust resources: bandwidth, CPU cycles, memory, connection limits, until the server can no longer respond to legitimate requests. The target is availability, not confidentiality or integrity.
How DDoS Attacks Work
Every server and network connection has finite capacity. A web server can handle a certain number of concurrent connections. A network uplink can carry a certain amount of traffic per second. A CPU can process a certain number of requests per second. DDoS attacks work by exceeding these limits.
When a server receives more requests than it can process, it queues them. As the queue grows, response times increase. When the queue fills completely, new requests are dropped. From the user’s perspective, the website becomes slow, then times out, then becomes completely unreachable.
The distributed nature of the attack is what makes simple defences ineffective. Blocking a single IP address stops nothing when the attack comes from ten thousand IP addresses simultaneously, spread across dozens of countries.
The Three Main Categories of DDoS Attack
DDoS attacks target different layers of the network and application stack. Understanding which layer is under attack determines what mitigation approach applies.
Volumetric Attacks
Volumetric attacks target network bandwidth. The attacker generates enormous quantities of traffic, measured in gigabits per second or even terabits per second, with the goal of saturating the target’s network uplink entirely.
When the uplink is saturated, no traffic can get through, not because the server has failed, but because the network pipe is full. UDP floods and ICMP floods are common volumetric attack types. DNS amplification attacks exploit misconfigured DNS servers to multiply attack traffic, allowing an attacker to generate far more outbound traffic than they themselves send.
Volumetric attacks require network-level mitigation, typically scrubbing centres that filter traffic upstream before it reaches the target server, or anycast routing that distributes attack traffic across a large network.
Protocol Attacks
Protocol attacks exploit weaknesses in network protocols to consume server or network device resources without necessarily saturating bandwidth. SYN flood attacks are the most common example: they exploit the TCP three-way handshake by sending large numbers of SYN packets without completing the handshake. Each incomplete handshake consumes a connection slot on the server, eventually exhausting the connection table and preventing legitimate connections from being established.
Ping of Death and fragmentation attacks exploit protocol handling vulnerabilities in older or misconfigured network equipment. Protocol attacks are typically measured in packets per second rather than bits per second.
Application-Layer Attacks
Application-layer attacks target the web application itself rather than the network. Rather than sending raw network traffic, they send carefully crafted HTTP requests that look like legitimate browser traffic and require the server to execute application logic: database queries, template rendering, authentication checks, before returning a response.
Slowloris is a well-known application-layer attack: it opens many simultaneous connections to the server and sends partial HTTP headers slowly, keeping connections open and occupying server connection slots without completing requests. HTTP flood attacks send large volumes of seemingly legitimate GET or POST requests.
Application-layer attacks are the hardest to mitigate because the traffic often appears normal at the network level. Effective mitigation requires distinguishing malicious request patterns from legitimate user behaviour, a task that requires application-level intelligence rather than simple network-level filtering.
📖 How does a CDN help absorb DDoS traffic?
CDN edge networks distribute traffic across global infrastructure, which is also what makes them effective at absorbing volumetric DDoS attacks. Read What Is a Content Delivery Network (CDN) and Why Your Site Needs It, including how CDN DDoS mitigation works at the edge.
How DDoS Attacks Affect Website Performance
A DDoS attack does not always take a website completely offline. Many attacks produce a spectrum of performance degradation that ranges from slow response times to intermittent unavailability to complete outage.
Increased Latency Before the Outage
Before a server is overwhelmed entirely, incoming attack traffic competes with legitimate traffic for bandwidth and processing capacity. Legitimate requests slow down as the server queue grows. Pages take longer to load. Time to First Byte increases. Users experience sluggish performance that looks like ordinary slowness without an obvious cause.
This degraded-but-not-offline state is often the first visible sign of an attack in progress, and it is frequently misidentified as an application performance problem rather than a network-level attack.
Connection Exhaustion
Protocol attacks specifically target connection limits. When connection tables fill up, either at the server level or at the network device level, new legitimate connections cannot be established. Users see connection timeout errors rather than slow responses. The web server may still be technically running, but no one can reach it.
Resource Exhaustion
Application-layer attacks cause genuine application load: database queries execute, application code runs, responses are partially generated. Each malicious request consumes real CPU and memory resources. As attack traffic scales, the server’s CPU and memory approach their limits, degrading performance for all requests including legitimate ones.
When resource exhaustion is severe enough, the operating system may begin terminating processes to free memory, the Linux OOM killer, which can cause application components to crash even after the attack traffic stops.
DNS Availability Impact
Some DDoS attacks target DNS infrastructure rather than or in addition to the web server. If the DNS servers responsible for a domain become unavailable, users cannot resolve the domain to an IP address, making the website unreachable even if the web server itself is functioning normally.
The Business Impact of a DDoS Attack
A DDoS attack is not purely a technical event. Its consequences extend to revenue, reputation, and customer relationships.
Revenue loss is the most immediate measurable impact. An e-commerce store that is unavailable during a promotional event or peak trading period loses sales that do not recover when the store comes back online. A SaaS platform that is down during business hours loses the subscription value of those hours for affected customers.
SLA violations compound the financial impact for SaaS businesses with enterprise customers. Contractual uptime commitments that are not met trigger penalty clauses and create legal liability independent of the customer trust damage.
Brand damage outlasts the attack itself. Customers who cannot access a service during a critical moment: a purchase, a booking, a support interaction, remember the failure. Trust erodes in ways that are difficult to quantify but very real in their long-term effect on retention and reputation.
Competitor advantage is a less-discussed but real consequence. Competitors with better availability benefit when your platform is down and their alternatives are accessible.
Distinguishing DDoS from Legitimate Traffic Spikes
Not every sudden traffic increase is an attack. Distinguishing between a DDoS attack and a legitimate traffic surge: a viral article, a successful marketing campaign, a product launch, matters because the responses are completely different.
Legitimate traffic spikes have business context. They correlate with a campaign launch, a press mention, or a social media post. The traffic comes from real users with normal behaviour patterns: they navigate between pages, they scroll, they convert. Traffic spikes from legitimate sources typically ramp up gradually and return to normal over minutes or hours.
DDoS traffic is characterised by different patterns. It often arrives suddenly without any preceding business event. The geographic distribution may be unusual, high traffic from locations where you have no normal user base. Request patterns are abnormal: high request rates from single IPs or small IP ranges, requests for the same URL repeatedly, requests with missing or unusual headers, low or zero completion rates.
Effective monitoring makes this distinction visible. Without monitoring, both can look the same from inside a slow and struggling server.
📖 What monitoring tools help detect DDoS attacks early?
Early detection is the difference between an absorbed attack and a full outage. Read Best Tools to Monitor Dedicated Server Performance, covering the network and resource monitoring approaches that make anomalous traffic visible before it becomes a crisis.
DDoS Mitigation Approaches
No single mitigation technique addresses all DDoS attack types. Effective protection typically combines multiple layers.
Rate Limiting
Rate limiting restricts how many requests a single IP address or client can make within a defined time window. It reduces the effectiveness of attacks that rely on high request volumes from individual sources. However, rate limiting alone is ineffective against distributed attacks where each of thousands of attacking IPs sends relatively few requests.
Network-Level Filtering and Scrubbing
Traffic scrubbing services route incoming traffic through filtering infrastructure before it reaches the origin server. Attack traffic is identified and dropped; legitimate traffic passes through. Scrubbing services operate at the network level and can handle volumetric attacks that would otherwise saturate the origin’s uplink.
Anycast routing is a related technique: traffic destined for a single IP address is routed to the nearest in a network of geographically distributed nodes. Attack traffic is distributed across the entire network rather than concentrating on a single point.
Web Application Firewall
A WAF inspects HTTP traffic at the application layer and blocks requests matching known attack patterns. WAFs are effective against application-layer attacks that bypass network-level filtering. CDN providers offer WAF capabilities at the edge, which means malicious requests are filtered before they reach the origin server at all.
DDoS Protection Services
Dedicated DDoS protection services: Cloudflare, Akamai, AWS Shield, combine scrubbing, anycast, WAF, and bot management into integrated platforms. They provide protection at scale that is impractical to build independently, particularly for volumetric attacks measured in hundreds of gigabits per second.
Infrastructure Design for Resilience
Mitigation services reduce attack impact, but infrastructure design determines how much the server can absorb before mitigation kicks in and how quickly it recovers.
Dedicated servers offer specific advantages in DDoS scenarios. Exclusive network interfaces mean attack traffic targeting your server does not degrade other tenants, and other tenants’ attack traffic does not degrade you. Higher baseline network capacity means more attack volume can be absorbed before the uplink saturates. Full configuration control means you can implement custom firewall rules and rate limiting policies without restriction.
DNS and DDoS Resilience
DNS infrastructure resilience is part of DDoS defence. An attacker who cannot take down the web server directly may attempt to attack DNS instead, making the domain unresolvable without touching the server at all.
Redundant authoritative DNS across multiple providers means that an attack targeting one provider’s infrastructure does not make the domain unreachable. Anycast DNS routing distributes DNS traffic across multiple nodes, making volumetric attacks against DNS less effective.
Reviewing DNS resilience as part of overall availability planning ensures that DDoS protection covers the full path between a user’s browser and your server, not just the server itself.
Infrastructure built for availability under attack
Swify dedicated servers give you exclusive network capacity, full firewall control, and European data centre infrastructure, the foundation for building DDoS resilience that shared environments structurally cannot provide.
→ Explore Swify Dedicated ServersFrequently Asked Questions
What is the difference between a DDoS attack and a DoS attack?
A DoS (Denial of Service) attack originates from a single source, one machine or one network connection sending traffic to overwhelm a target. A DDoS (Distributed Denial of Service) attack uses many sources simultaneously, typically thousands of compromised devices forming a botnet.
The distinction matters for mitigation: a DoS attack can be stopped by blocking a single IP address or network range. A DDoS attack distributes traffic across thousands of IP addresses in many countries, making simple IP blocking ineffective. DDoS attacks are also capable of generating far more traffic than any single machine can produce, enabling attacks at scales that can overwhelm even well-resourced infrastructure without dedicated mitigation services.
Can a DDoS attack steal data or compromise a server?
A DDoS attack on its own does not steal data or gain unauthorised access to a server. Its purpose is availability disruption, preventing legitimate users from reaching the service, not data exfiltration or system compromise.
However, DDoS attacks are sometimes used as a distraction alongside other attacks. While security teams focus on the DDoS, an attacker attempts a separate intrusion elsewhere. In this scenario, the DDoS is a smokescreen rather than the primary objective. Maintaining security monitoring during a DDoS event, not just availability monitoring, ensures that a concurrent intrusion attempt does not go undetected. Read more about security monitoring in Dedicated Server Security: Best Practices for Protecting Your Infrastructure.
Are dedicated servers more resilient to DDoS attacks than shared hosting?
Yes, in several meaningful ways. On shared hosting, attack traffic targeting one tenant can degrade performance for all others sharing the same physical network, and attack traffic targeting other tenants can degrade yours. Dedicated servers eliminate this cross-tenant contamination: your network interface serves only your traffic.
Dedicated servers also give you full control over firewall configuration, rate limiting rules, and network settings, allowing you to implement custom DDoS mitigation without the restrictions that shared environments typically impose. Higher baseline network capacity means more attack volume can be absorbed before the server’s uplink saturates. Read more about the security advantages of isolated infrastructure in Why Isolated Infrastructure Reduces Cybersecurity Risks.
How long do DDoS attacks typically last?
Attack duration varies enormously. Many attacks last minutes to hours, short enough to cause disruption without sustaining the resource cost of running the botnet continuously. Some attacks are sustained over days or weeks, particularly when the target represents significant financial or competitive value to the attacker.
Multi-vector attacks combine different attack types, volumetric followed by application-layer, or simultaneous attacks at multiple layers, to probe for weaknesses and make mitigation harder. The unpredictability of duration and type is part of what makes DDoS preparation important: mitigation strategies that only address one attack type or duration leave gaps that a determined attacker will find.
Does DDoS protection affect legitimate website performance?
Well-configured DDoS protection has minimal impact on legitimate user performance under normal conditions. Traffic scrubbing and WAF filtering add a small amount of latency, typically single-digit milliseconds, that is imperceptible to users. Rate limiting, when set at appropriate thresholds above normal user behaviour, does not affect legitimate requests.
During an active attack, some mitigation measures, particularly aggressive rate limiting and CAPTCHA challenges, may create friction for legitimate users. This is a trade-off: the alternative is the site becoming completely unavailable. The goal of mitigation is to maintain acceptable performance for legitimate users while blocking attack traffic, which is achieved through careful threshold configuration rather than blanket restrictions. Read more about how dedicated infrastructure handles traffic under load in Understanding Server Load: How Dedicated Servers Handle High Traffic.
When should a business invest in dedicated DDoS protection?
The threshold for investing in dedicated DDoS protection is directly related to the cost of downtime. When an hour of unavailability produces measurable revenue loss, customer churn, or SLA liability, the cost of protection is almost always lower than the cost of an unmitigated attack.
Businesses in sectors that attract motivated attackers: gaming, financial services, e-commerce, media, cryptocurrency, face higher attack probability and should invest in protection earlier. Similarly, platforms with public-facing APIs, high-profile brand presence, or politically sensitive content are higher-risk targets. A basic layer of protection, Cloudflare’s free or paid DDoS mitigation, for example, is appropriate for most websites. Dedicated DDoS scrubbing services become relevant when attack sophistication or volume exceeds what standard CDN-layer mitigation handles. Read more about building a complete security posture in Dedicated Server Security: Best Practices for Protecting Your Infrastructure.