DDoS protection for small businesses: what you need and what is marketing
What a denial-of-service attack does to a small site, which protections actually matter, and why a static site behind a network layer already has most of them.
The short answer
A distributed denial-of-service attack floods a website with traffic from many sources at once so that real visitors cannot get through. It does not steal data; it takes the site down, and on usage-billed platforms it can run up a bill. The protection that matters for a small business is not a product to buy but an arrangement to have: a network layer in front of the site that absorbs and filters floods at the edge before they reach anything of yours, and an architecture with nothing fragile to overwhelm. A static site served from an edge network behind a filtering layer already has most of what is needed; the exposed parts are any server, function or origin that can be reached directly. Paid enterprise protection exists for organisations that are specifically targeted or run large dynamic applications. For a small business, the standard layer, sensible rate limits and provider caps are enough, and the marketing beyond that is for someone else.
What protects and what does not
| Measure | What it does | Small business relevance |
|---|---|---|
| A network layer in front | Absorbs floods across a global network; filters known attack traffic; hides the origin | Essential and usually sufficient |
| Static architecture | Pages are files at the edge; nothing computes per request | Floods hit cached copies; nothing falls over |
| Origin not directly reachable | Attackers cannot bypass the layer to hit the server | Important; check it |
| Rate limits per source | Stops one source from making thousands of requests | Important for forms and functions |
| Provider caps | Bounds the bill if a flood reaches billable resources | Important; set before needed |
| Caching of dynamic pages where possible | Floods served from cache rather than computed | Useful |
| Paid enterprise tiers | More capacity, custom rules, guarantees, support | For specific targets and large applications |
| A security plugin on the site | Runs on the thing being flooded | Not a defence against floods |
Checking your protection
- Confirm the site is behind a filtering network layer with DNS pointing at it.
- Confirm the origin and functions are not directly reachable by their own addresses.
- Set rate limits on forms, login and function endpoints.
- Set provider caps on usage so a flood is a bounded cost.
- Cache what can be cached, so floods hit copies.
- Know where the attack analytics are and who looks when traffic spikes.
- Decide in advance what the response is: usually nothing, because the layer handles it; sometimes a temporary challenge on all traffic.
When paid protection is justified
An organisation that is a specific, repeated target. A large dynamic application where much traffic must reach the origin. Contractual or regulatory requirements for guarantees and support. Campaigns or events where the cost of any outage is very high. In those cases the paid tiers add capacity, controls and people. For a small business site that is static behind the standard layer, the paid tier protects against a problem the architecture already solved.
What this means for you
Put the site behind a filtering network layer, keep the pages static, hide the origin, set rate limits and provider caps, and know where to look when traffic spikes. That is the DDoS protection a small business needs, and it is mostly free. Buy the enterprise tier when you are a specific target or run a large application; otherwise the marketing is describing a problem your architecture does not have.
Frequently asked questions
Would anyone bother attacking our small site?
Attacks are often indiscriminate, automated or bought cheaply by someone with a grudge, and small sites are hit as collateral or as targets of opportunity. The question is less whether it will happen than whether it matters when it does: a static site behind a filtering layer barely notices; a single server running everything falls over.
Do we need to buy DDoS protection?
A small business gets what it needs from the standard protection of a network layer in front of the site and a static architecture with nothing fragile to overwhelm. Paid tiers add capacity and controls for organisations that are specifically targeted or run large dynamic applications. Before paying, confirm the site is behind a filtering layer, that functions and origins are not directly reachable, and that caps and rate limits are set.
Can an attack cost us money even if the site stays up?
Yes, on usage-billed platforms: floods of requests to functions or uncached pages can run up bills. The defences are caps at the provider, rate limits per source, caching so floods hit cached copies, and the filtering layer dropping obvious attack traffic. Check the caps before you need them.
Sources
- Cloudflare Learning Center: What is a DDoS attack? (accessed 2026-09-12)