The short answer: a denial-of-service (DoS) attack floods a website with junk traffic until real customers can't get through — a crowd blocking your shop's door. A DDoS (distributed DoS) does it with thousands of hijacked machines at once, which is the form that actually occurs today. It's an attack on availability, not your data — nothing is stolen. And for most small businesses, the honest risk picture is calmer than the headlines: targeted attacks are uncommon, and basic protection is inexpensive or already included in modern hosting.
DoS vs DDoS, in one minute
DoS = one source sending overwhelming or malformed traffic. Rare now, because a single source is easy to block. DDoS = the distributed version: an attacker rents or controls a "botnet" of compromised devices around the world and points them all at one target. From your side both look the same — the site crawls, then stops responding — but the distributed kind is why the fix is done at the network level, not on your server.
What an attack looks like from the owner's chair
- The site suddenly becomes extremely slow or completely unreachable — often with no error, just endless loading.
- Your hosting dashboard shows a massive traffic spike from nowhere — thousands of "visitors" with no matching sales or inquiries.
- Your host emails about resource limits, or preemptively suspends the site to protect its other customers.
Important context: most small-business outages that feel like attacks aren't. Expired certificates, hosting failures, a bad plugin update, or a traffic surge from genuine attention (a mention going viral) are all far more common. Diagnose before assuming malice.
The honest risk picture
Targeted DDoS attacks are mostly aimed at gaming services, exchanges, political targets, and businesses someone has a specific grievance with (including, unpleasantly, extortion attempts against e-commerce sites at peak season). A typical local-service or small e-commerce site is far more likely to suffer from indiscriminate bot traffic — scrapers and credential-stuffing bots that degrade performance without "attacking" you specifically. The protections below cover both.
Protection, cheapest first
- Check what you already have. Ask your host one question: "Is DDoS mitigation included in my plan?" Many modern hosts and platforms include network-level protection by default.
- Put a protective layer in front. A CDN/security service (Cloudflare is the widely-known example; most hosts have equivalents) absorbs and filters hostile traffic before it reaches your site — free tiers exist and are meaningful.
- Keep the site lean and cached. A fast, cached site survives traffic spikes — hostile or viral — far better than a heavy one. (Related: why is my site slow?)
- Know your host's emergency contact before you need it, and keep an off-site copy of your site so recovery never depends on one vendor's worst day.
If it's happening right now
Contact your host first — mitigation happens at their level. Don't pay extortion demands; report them (in the US, the FBI's IC3 takes these reports). Once stable, do a precautionary check of admin accounts and logs — outages are occasionally used as cover — and then decide on the protective layer above so round two bounces off.
Common questions
Does a DoS attack mean my data was stolen?
No — it targets availability, not data. It blocks the door; it doesn't break in. Check accounts and logs afterward as a precaution, since noise is occasionally used as cover.
Is my small business actually at risk?
Targeted attacks on small businesses are relatively uncommon; hosting problems and indiscriminate bots explain most bad days. The sensible posture — mitigation-included hosting or a protective CDN layer — is cheap or free.
Can I stop a DDoS attack myself?
Not from your own server — the traffic has to be absorbed upstream. That's your host's and CDN's job, which is why the preparation step is simply making sure that layer exists before you need it.
Check your security posture the measured way
The Grader reads Security as one of six lenses — certificate, headers, redirects and more — explained without the fear-mongering.
Grade my site Fix a "Not Secure" warning