DDoS protection for small UK websites

There is a comforting story small business owners tell themselves about online attacks. We are too small to bother with, the thinking goes, so why would anyone target us. It feels sensible right up until a wave of junk traffic takes the site down on a Friday afternoon and nobody can explain why.

Distributed denial of service attacks rarely care how big you are. A great many are automated, indiscriminate, and aimed at whatever happens to be reachable. Understanding what they do, and what actually stops them, is worth an hour of any owner's time.

Small sites get hit too#

Attackers do not always pick a target on purpose. Botnets sweep across huge ranges of addresses looking for anything that responds, and a small site on shared infrastructure can be caught in the blast aimed at a neighbour. Some attacks are extortion, some are a disgruntled competitor, and a surprising number are simply collateral.

The National Cyber Security Centre treats this as a baseline risk for organisations of every size, and its denial of service guidance is written for normal businesses rather than security specialists. The headline message is simple. Being small is not protection.

What a DDoS attack actually does#

The aim of a denial of service attack is exhaustion. The attacker sends so many requests, from so many sources at once, that your server runs out of the capacity to answer real visitors. The site does not get hacked in the sense of data being stolen. It just gets buried.

Those requests can hit different layers. Some flood your network connection with sheer volume. Others target the application itself, making requests that look legitimate but force the server to do expensive work each time. The OWASP community keeps a clear write up of denial of service techniques that explains why the application layer ones are the hardest to spot, because each request can look like a genuine customer.

Layers of defence#

No single product makes you immune. Real protection is layered, with each layer catching what the one before it missed.

Edge filtering#

The most effective defence sits in front of your server, out at the edge of a large network. A provider with global capacity can absorb a flood and filter out the malicious traffic before it ever reaches your hosting, because they have far more bandwidth than any attacker can realistically throw. Cloudflare's learning centre article on DDoS attacks describes this scrubbing approach well. The principle is to soak up the wave somewhere with room to spare.

Rate limits#

Closer to home, rate limiting caps how many requests a single source can make in a given window. A real person clicking around your site never trips it, but a bot hammering your login page hundreds of times a second meets a 429 Too Many Requests response instead. Combined with sensible blocking of known bad sources, it quietly removes a large slice of automated noise.

What to do mid attack#

If you are being hit right now, resist the urge to start changing things at random. Contact your host first, because for most small businesses the host is the one with the tools and the bandwidth to respond. Tell them what you are seeing and when it started.

While they work, avoid making the situation worse. Do not panic and rebuild DNS records, and do not disable the very protections that might be helping. Keep a record of timings and symptoms, which helps afterwards. The honest truth is that mid attack is the wrong time to learn your defences, which is exactly why the ten steps to cyber security put the planning firmly before the incident.

Choosing a host that absorbs it#

The single most useful decision you can make is to host somewhere that treats mitigation as part of the service rather than an upsell you reach for in a crisis. Ask a prospective provider a direct question. What happens to my site when an attack hits, and is protection always on or something I have to enable.

A good answer involves always on filtering at the network edge, the capacity to absorb large volumes, and support that picks up the phone in your time zone. Our DDoS protection is built in rather than bolted on, and it sits alongside the wider security tooling that keeps everyday threats away from your site. The goal is that the worst attacks are handled before you even know they happened, which is the only outcome a busy business owner really wants.