What a DDoS attack is and why blocking it matters

A DDoS attack (distributed denial of service) floods your network or website with so much fake traffic that real users cannot connect. Attackers send requests from thousands of computers at once, overwhelming your connection or server until it stops responding. Unlike a virus that steals data, a DDoS attack's goal is straightforward to knock you offline.

If you run a website or online service, a DDoS attack can cost you customers and revenue for hours or days. If you are a regular user, DDoS attacks are rare but possible — they usually target businesses, not individuals. The blocking strategies differ depending on what you are protecting: a personal device, a home network, or a business server.

Key Takeaways

  • Most DDoS attacks target websites and servers, not personal computers, so individual users rarely need specialized DDoS protection.
  • A basic firewall on your device and router already blocks many attack types by filtering suspicious traffic patterns.
  • Website owners can use a content delivery network (CDN) like Cloudflare or Akamai to absorb and filter DDoS traffic before it reaches their server.
  • Internet service providers (ISPs) can sometimes detect and block DDoS traffic at the network level if you contact them during an attack.
  • DDoS protection services exist but cost money and work best when set up before an attack happens, not during one.

How firewalls and routers already block some DDoS traffic

Your device's built-in firewall and your home router both filter incoming traffic by default. They drop packets (small chunks of data) that do not match expected patterns, which blocks some straightforward DDoS attempts automatically. Windows Defender Firewall on Windows and the built-in firewall on Mac both do this without any setup from you.

A home router does the same thing — it sits between your devices and the internet, and it rejects traffic that looks malformed or suspicious. This is why a basic DDoS attack against a home network often fails: the router's firewall stops it before it reaches any device. However, large or sophisticated attacks can overwhelm even a good firewall, so this protection is a starting point, not a complete solution.

Using a content delivery network to protect a website

If you own a website, the most practical way to block DDoS attacks is to route your traffic through a content delivery network (CDN). A CDN like Cloudflare, Akamai, or AWS Shield sits between your visitors and your server. When an attack happens, the CDN absorbs the fake traffic, filters it, and only sends legitimate requests to your actual server.

Cloudflare's free tier includes basic DDoS protection and works for most small websites. You change your domain's nameservers to point to Cloudflare instead of your hosting provider, and Cloudflare handles the filtering. Paid tiers offer stronger protection against larger attacks. Akamai and AWS Shield cost more but are built for high-traffic websites that need industrial-strength defense.

Setting up a CDN takes about an hour and requires access to your domain registrar (the company where you bought your domain name). The CDN then caches your website's content on servers around the world, which also makes your site faster for visitors — a useful side effect.

Contacting your ISP during an active attack

If your website is under attack right now and you do not have a CDN in place, contact your internet service provider. Your ISP can sometimes detect the attack at the network level and filter it before the traffic reaches your connection. This is not a permanent solution, but it can buy you time to set up a CDN or move to a hosting provider with built-in DDoS protection.

Call your ISP's technical support line and explain that you are receiving a DDoS attack. They will ask for details: your IP address, when the attack started, and what kind of traffic you are seeing. Some ISPs have DDoS mitigation services available for an extra fee, though response times vary. Larger ISPs like Comcast or Verizon are more likely to have the tools to help than smaller regional providers.

DDoS protection services for businesses

Companies that expect attacks or have been attacked before often subscribe to dedicated DDoS protection services. These services monitor your traffic 24/7, detect attacks automatically, and reroute traffic through their filtering systems. Examples include Cloudflare's paid plans, AWS Shield Advanced, Imperva, and Neustar UltraDDoS.

These services cost between $200 and $3,000 per month depending on the size of your network and the level of protection. They work best when you set them up before an attack happens, because they need time to learn what your normal traffic looks like. If you set one up during an active attack, it still helps, but the first few minutes of the attack may still affect your service.

Most of these services also provide a report after the attack showing where the traffic came from, what type of attack it was, and how much traffic they blocked. This information is useful for understanding whether you need stronger protection in the future.

What does not work against DDoS attacks

A VPN does not protect you from DDoS attacks. A VPN encrypts your traffic and hides your IP address from websites, but it does not filter incoming attack traffic. If anything, routing your traffic through a VPN during an attack may slow your connection further.

Antivirus software does not stop DDoS attacks either. DDoS is a network-level attack, not a malware infection, so antivirus tools cannot detect or block it. The same applies to ad blockers and browser extensions — they work on your device, but DDoS traffic never reaches your browser.

Paying the attacker to stop is not recommended. Ransom demands sometimes accompany DDoS threats, but paying does not may provide the attack will stop, and it encourages more attacks. Law enforcement agencies advise against paying.

Steps to take if you think you are under attack

If your website suddenly becomes slow or unreachable, check whether you are actually under attack or whether the problem is something else. Use a free tool like Downdetector or your hosting provider's status page to see if other customers are affected. If only your site is down, log into your hosting control panel and check your bandwidth usage — a DDoS attack shows as a sudden spike in traffic from many different IP addresses.

If you confirm an attack is happening, take these steps in order. First, contact your hosting provider and tell them what you see. Second, if you do not already use a CDN, sign up for Cloudflare's free tier when ready — you can have it running in 30 minutes. Third, contact your ISP if the attack is still ongoing after the CDN is active. Fourth, if attacks continue over days or weeks, subscribe to a paid DDoS protection service.

Document the attack: take screenshots of your traffic graphs, note the dates and times, and save any ransom emails. This information helps your hosting provider, ISP, and law enforcement understand what happened.

Frequently Asked Questions

Can a DDoS attack steal my data or install malware?

No. A DDoS attack only tries to knock you offline by flooding your connection with traffic. It does not break into your system, steal passwords, or install software. However, attackers sometimes use a DDoS as a distraction while they attempt a real hack, so treat an attack as a sign to review your security.

Is DDoS protection worth the cost for a small business?

It depends on your industry and whether you have been attacked before. If you run an e-commerce site, online service, or anything that loses money when you are offline, basic protection through Cloudflare's free tier is worth setting up. Paid services make sense only if you have experienced attacks or operate in a high-risk industry like gaming or cryptocurrency.

How long does a DDoS attack usually last?

Most attacks last between a few minutes and a few hours. Some last days if the attacker has a specific goal or grudge. Once you have a CDN or DDoS protection in place, the attack becomes invisible to your users — they see no slowdown even though the attack is still happening in the background.

Can I trace who is attacking me?

The IP addresses in the attack traffic are usually spoofed (fake) or belong to compromised computers, so tracing them is difficult. Law enforcement can sometimes work backward through ISPs to find the attacker, but this requires a serious crime and takes months. For most attacks, the goal is just to report it to your hosting provider and move on.

Do I need DDoS protection if I use a hosting provider like Shopify or Wix?

No. Shopify, Wix, Squarespace, and similar platforms handle DDoS protection for you as part of their service. Their infrastructure is built to absorb attacks. You only need separate DDoS protection if you host your own server or use a basic hosting provider without built-in protection.