DDoS Protection: Understanding and Mitigating Attacks

A DDoS protection for websites aims to prevent a denial-of-service attack from making your site inaccessible. These attacks are straightforward to understand, but their consequences can be severe: an unresponsive site, lost customers, and tarnished reputation. Here’s how they work and proven methods to mitigate them.

What is a DDoS attack and how to protect against it?

DDoS stands for « Distributed Denial of Service ». The principle involves overwhelming a server or network with such a massive volume of traffic that it can no longer respond to legitimate visitors.

What makes the attack « distributed » is that it does not originate from a single machine, but from thousands of compromised devices — computers, servers, or IoT devices — controlled remotely. This collection forms a network of zombie machines (botnet). Each device sends requests to your server, and the massive accumulation eventually saturates the resources.

Volumetric or Application-Layer?

Two major families of attacks are distinguished, which are not neutralized in the same way.

A volumetric attack aims to saturate bandwidth or network capacity: a traffic volume exceeding what the connection can absorb is injected. The server, even if overprovisioned, becomes unreachable because the network channel is congested.

An application-layer attack directly targets the software layer (Layer 7): the requests appear legitimate, but heavily stress computing resources — for example, thousands of simultaneous calls on a resource-heavy page with database queries, or an « HTTP flood » attack that multiplies requests until the processor or memory is exhausted.

This distinction is crucial: a volumetric attack is filtered upstream at the network level, whereas an application-layer attack requires inspecting the actual content of the requests.

A concrete example: an online store victim of a volumetric attack sees its network link saturated and becomes unreachable for all visitors, without any requests necessarily reaching the web server. Conversely, during an « HTTP flood », the requests appear normal, but their excessive volume exhausts the application server, even while the network still has free bandwidth.

The Role of the Application Firewall (WAF)

The application firewall, or WAF (Web Application Firewall), filters HTTP/HTTPS traffic by applying a set of security rules. It intercepts requests matching known attack patterns — SQL injections, XSS vulnerabilities, attempts to exploit application vulnerabilities — before they reach your code.

It is an indispensable complement, but not a standalone solution: a well-configured WAF blocks a large portion of malicious application traffic, but cannot absorb a purely volumetric saturation on its own. These two layers of protection must be strictly combined.

CDN and Traffic Absorption

A CDN (Content Delivery Network) distributes your static content (cached pages, images, style sheets) from relay servers located closest to visitors. In the face of an attack, it plays a strategic role: it absorbs and disperses traffic across a massively distributed global infrastructure, which dilutes the impact of a volumetric attack well before it reaches your origin server.

This is why many architectures place a CDN equipped with an application firewall in-line in front of the infrastructure: traffic is filtered and cached at the network edge, and your origin server only processes the remaining legitimate traffic. This is the principle of the « CDN and application firewall » component integrated into Atlas Hoster's high availability architecture.

Rate Limiting and Blocking Lists

Two complementary mechanisms strengthen this setup.

Rate limiting (rate limiting) restricts the number of requests an IP address or client can send within a given time interval. Beyond the set threshold, excess requests are throttled or rejected with an HTTP 429 error code. This mechanism is particularly effective against application-layer attacks based on massive repetition.

Blocking lists allow you to immediately reject traffic from IP addresses or subnets identified as malicious. This is a reactive measure, useful during an incident: our guide on blocking an IP or a domain details its implementation.

For example, limiting the same address to a few dozen requests per second helps filter out most automated attacks without penalizing legitimate visitors' browsing.

What to Do During an Attack?

If your site is under attack, proceed methodically in steps:

1. Confirm that it is indeed an attack (sudden spike in atypical traffic) and not a legitimate increase in audience.
2. Activate available protections: rate limiting, blocking lists, or your CDN's emergency « under attack » mode.
3. Notify your hosting provider: their technical team can intervene at the network or routing level to mitigate the traffic.
4. Monitor the return to normal, then analyze access logs to permanently adjust your security rules.

Keep a detailed record of the incident: network and server logs will be used to document the event and refine your detection thresholds.

If you host multiple sites on the same account, an attack targeting one of them can degrade the performance of others. Isolating each application or separating environments — see our guide on additional domains — prevents the spread of unavailability.

The best defense remains anticipation: an architecture designed to absorb spikes and filter hostile traffic regains availability much faster. Security and performance go hand in hand: check our article on high availability, our WordPress security guide as well as our article on switching to HTTPS.

For hosting that deploys a CDN with an application firewall in front of your infrastructure, discover Atlas Hoster's high availability offer.

Pitfalls to Avoid

• Confusing legitimate spikes with attacks: a marketing campaign or media mention can generate a massive influx. Analyze the nature of the requests before applying strict blocks.
• Assuming a single tool is enough: the WAF inspects application requests, but does not mitigate bandwidth saturation. Defense layers must be cumulative.
• Waiting for the incident to act: filtering rules and secure routing are prepared in advance.
• Blocking too broadly: geographic filtering or a poorly calibrated blocking list risks excluding legitimate customers.

Frequently Asked Questions

Can a DDoS attack lead to data theft?

In principle, no. A DDoS attack aims to saturate resources to make the service unavailable, not to steal data. Nevertheless, a DDoS attack is sometimes used as a diversion to divert attention during a targeted intrusion attempt: stay vigilant.

Can a low-traffic site be targeted?

Yes. Most attacks are automated and launched by tools blindly scanning the network. Any site accessible online can be targeted, whether by opportunism or targeting error.

Does my hosting provider automatically protect me?

It depends on the subscribed service level. Most hosting providers offer basic network mitigation against very large volumes, but fine-grained protection against application-layer attacks often requires a specialized CDN and a managed WAF. Check your contract's guarantees before facing one.