What Is a DDoS Attack?

A DDoS (distributed denial-of-service) attack is a malicious attempt to knock a website, server, or network offline by flooding it with traffic. The traffic comes from many machines at once, not one. Attackers control a botnet, a network of hijacked computers and internet-connected devices, so the flood arrives from thousands of sources. The target gets so overwhelmed that real visitors can no longer get through, which is the whole point.

How does a DDoS attack work?

A DDoS attack points many machines at one target until it runs out of capacity to answer. Cloudflare defines it as an attempt to disrupt normal traffic by "overwhelming the target ... with a flood of Internet traffic" (Cloudflare, accessed August 2026).

The machines doing the flooding are usually not the attacker's own. They are ordinary computers and IoT devices, such as routers or cameras, quietly infected with malware.

Each infected device is called a bot, or zombie, and a group of them is a botnet. The owner of the device often has no idea it is taking part.

That is what the extra D adds. A plain DoS (denial-of-service) attack comes from a single source, which is easy to identify and block. A DDoS spreads the attack across thousands of addresses, so there is no single plug to pull.

What are the main types of DDoS attack?

DDoS attacks are usually grouped by which part of your infrastructure they try to exhaust. Cloudflare names three broad categories, aimed at different layers of the connection.

Type	What it targets	How it hits you
Volumetric	Your bandwidth	Consumes the capacity between you and the internet
Protocol	Servers, firewalls, load balancers (layers 3–4)	Exhausts equipment that manages connections
Application-layer	The web app itself (layer 7)	Floods the server with costly page requests

Source: category framing from Cloudflare, "What is a DDoS attack?" (accessed August 2026).

Volumetric attacks are the brute-force kind. They simply generate more traffic than your connection can carry.

Application-layer attacks are quieter and harder to spot. They send requests that look like normal page visits. A small number of them can tie up a server without an obvious traffic spike.

Why are DDoS attacks so hard to stop?

The core difficulty is telling attack traffic apart from real visitors. Cloudflare frames the whole challenge of mitigation as differentiating between attack traffic and normal traffic.

A botnet is built to look human. Its requests come from real devices in real locations, using ordinary browsers.

Block too aggressively and you turn away genuine customers along with the attack. That trade-off is why you cannot just switch a DDoS off. It is also why layered defenses exist, to filter traffic without a heavy hand.

How do you protect a website from a DDoS?

Protection means putting a service in front of your site that absorbs and filters a flood before it reaches your server. A few methods work together.

• A content delivery network (CDN) spreads traffic across many data centers, so an attack is scattered instead of landing on one machine.
• A web application firewall (WAF) inspects requests and drops the ones that match attack patterns.
• Rate limiting caps how many requests one source can make in a set time, which throttles obvious floods.

For most small Malaysian businesses, a targeted DDoS is not the most likely reason a site goes down. In our experience, a small site that suddenly stops loading has usually hit a shared-hosting limit during a traffic spike. Sometimes it has picked up a compromised plugin. Being singled out for a real attack is rarer than either.

That said, sitting behind a CDN is low-cost insurance. It speeds the site up on normal days and absorbs the abnormal ones. That is why we put client sites behind one by default, rather than waiting for a problem.

Frequently asked questions

What is the difference between a DoS and a DDoS attack?

A DoS (denial-of-service) attack floods a target from a single source, while a DDoS spreads the same attack across many machines at once. The distributed version is far harder to stop, because there is no single address to block. Almost every serious attack today is distributed, which is why DDoS is the term you usually hear.

Can a DDoS attack steal my data?

No, not on its own. A DDoS aims to make a site unavailable, not to break in or copy information. The risk is that the outage distracts your team. A separate attack can target your data while everyone is watching the traffic, so treat a sudden flood as a signal to watch everything.

How long does a DDoS attack last?

A DDoS attack can last from a few minutes to several days, depending on the attacker's resources and your defenses. Short bursts are common as a test or a nuisance. A prolonged attack usually means someone is motivated, and getting a CDN or a specialist involved quickly matters far more than waiting it out.

Is my small business website a likely target?

Usually not a primary one, but small sites are still hit. Many DDoS attacks are automated and indiscriminate, sweeping up any exposed server, and some target small businesses for extortion. The practical answer is that basic protection is inexpensive enough that you do not need to be a likely target to justify it.

Does a CDN stop DDoS attacks?

A CDN mitigates many DDoS attacks by spreading traffic across a large network that can absorb a flood, but it is not a complete shield on its own. Serious protection pairs a CDN with a WAF and rate limiting. For the vast majority of small business sites, that combination is more than enough.

Keeping your site standing

Storming Solutions builds and maintains websites for Malaysian businesses, and part of maintenance is putting the right protection in front of a site before trouble finds it. We would rather set up a CDN and sensible defenses at build time than scramble during an outage.

Worried your site could be knocked offline, or trying to work out why it went down? Ask on WhatsApp or read why a website goes down first, then talk to us about web development. We will look at how your site is protected and tell you honestly whether it needs more.