DDoS attacks on small websites: what actually happens and what helps

The short answer

A distributed denial-of-service attack floods a website with requests from many machines at once, usually a rented network of compromised computers and devices, so that the site cannot serve real visitors. It steals nothing; it takes the site down, and on usage-billed platforms it can run up a bill. Small business sites are hit more often than their owners expect: as collateral when they share infrastructure with a real target, as targets of opportunity found by scanners, as the opening move of an extortion attempt, and occasionally out of spite by someone who bought an hour of flood for the price of a lunch. What helps is architectural rather than a product installed on the site: a filtering network layer in front that absorbs the flood across many locations and drops known attack traffic, static pages that cost nothing to serve so a flood hits cached copies, an origin that cannot be reached directly, rate limits on the dynamic parts and cost caps at the provider. Nothing installed on the website itself defends against a flood, because the flood arrives before the site’s code runs.

What it looks like from each side

Moment	Single server, no layer in front	Static site behind a filtering layer
The flood begins	Requests hit the server directly; it saturates in seconds	Requests hit the layer’s many locations; known attack traffic is dropped
Minutes in	Site unreachable; email on the same server stops; host emails about limits	Dashboard shows a spike; visitors notice nothing
Response options	Wait, or scramble to put a layer in front under fire	Watch; optionally turn on a temporary challenge
Cost	Downtime, lost business, possibly overage charges	Nothing, or bounded by caps if the dynamic parts were hit
Afterwards	Post-mortem; the change that should have been made before	A line in the monthly report

The defence, in order of importance

Extortion and what to do about it

Some attacks arrive with an email: pay, or it continues. Paying funds the next attack and marks the business as a payer. The answer is the same architecture: move behind a filtering layer if not already there, hide the origin, enable a challenge if needed, keep the evidence and report it. Attacks that achieve nothing stop, because the attacker’s rented capacity is worth more elsewhere.

What this means for you

A denial-of-service attack on a small site is a flood you cannot stop with anything installed on the site. The defence is a filtering network layer in front, static pages, a hidden origin, rate limits, cost caps and monitoring, decided and set up before it happens. Behind that arrangement an attack is a spike in a dashboard; without it, it is a day offline and possibly a demand for money.