A business website can go offline for many reasons. One of the more frustrating ones is a denial of service attack. Someone floods your site with so much traffic that real customers cannot get through. The site may slow to a crawl or stop loading at all.
These attacks are not reserved for banks and big brands. Small business sites can be caught up in them too. The good news is that most of the useful work happens before anything goes wrong. A little planning with your host can make an attack far less painful.
What a denial of service attack is
The Australian Signals Directorate describes denial of service attacks as cyberattacks designed to disrupt or degrade online services. Those services include websites, email and the domain name system. The attack usually works by flooding a service with data, connections or requests. Legitimate users are then denied access.
A distributed denial of service attack, or DDoS, is the larger version. The traffic comes from many computers and connected devices at once. It arrives from many directions and at a much bigger scale. That makes it harder to block by simply turning away one source.
Attackers often take over poorly secured internet connected devices to build these networks. The guidance gives smart TVs, kettles and security systems as examples. These groups of hijacked devices are known as botnets. They may even be rented or sold to other attackers.
Why it matters for a small business
When your site is down, enquiries stop. Online orders stop. Paid traffic lands on a page that will not load. The ASD notes that these attacks can cause productivity and financial losses.
There is also the visitor’s experience to think about. A slow or broken site leaves a poor impression, even if the cause was outside your control. Good UX and UI design counts for little when the page never arrives. People rarely wait around to find out why.
The ASD makes a sobering point. Organisations cannot fully avoid being targeted. That is why the guidance puts so much weight on preparation. You cannot control who aims at your site, but you can control how ready you are.
Start with your hosting setup
Your hosting arrangement shapes how well a site copes with a flood of traffic. A cheap plan on a crowded server may have very little room to absorb a spike. If you are weighing up dedicated hosting vs VPS hosting, ask each provider about attack protection as well as speed and price. It is a fair question for any host.
The ASD guidance lists questions for your service providers. It suggests asking about their proven ability to resist attacks and their testing history. It also covers whether mitigation happens automatically and how pricing and billing limits work. Ask at what point they might shut a service down too.
That last point is easy to miss. Some providers have a set point at which they turn off a service during an attack. Others charge more as the traffic grows. The guidance warns that if response options were never discussed, a provider may be unable or unwilling to help. It may also charge extra.
Practical steps you can take now
The full ASD publication is written for a wide audience, including large organisations. Plenty of it still applies to a modest business site. Here are some of the steps it recommends that make sense for most owners.
- Decide which parts of your site must stay online and which can be switched off during an attack.
- Consider a content delivery network or a cloud based mitigation service that filters bad traffic before it reaches your server.
- Keep your email separate from your website, so one problem does not take down both.
- Prepare a simple static version of the site that needs very little processing or bandwidth.
- Turn on registrar locking for your domain and keep your registration details accurate.
- Keep current contact details for your host and other providers, plus a backup way to reach them.
The static fallback is worth a closer look. It can be a single page with your business name, opening hours and how to contact you. It loads quickly and puts little strain on the server. Customers still find the basics while the main site recovers.
The ASD also suggests real time monitoring and alerts. These can cover availability, traffic, processing resources and costs. Ask your host whether uptime alerts are part of your plan. Even a basic alert means you hear about an outage before your customers tell you.
Have a simple response plan
The guidance recommends an incident response plan that covers denial of service scenarios. It also suggests exercising that plan at least once a year. For a small business this does not need to be a thick document. A single page that says who to call and what to switch off can be enough.
During an attack, the ASD suggests activating your plan and asking providers to act straight away. It recommends switching off features you can live without, such as search, dynamic content or large files. Heavy media is a common example, so a site that leans on video SEO may want a lighter fallback ready. Keep talking to customers and providers while you monitor whether the site is available.
If the attack targets your server’s address directly, the guidance says changing that address can help. It adds that the new address should not be published until protections are in place. The ASD also recommends reporting attacks to the relevant authorities. In Australia, the ASD guide to preparing for and responding to denial of service attacks explains how to make contact through cyber.gov.au.
After the site is back
Once things settle, take a look at what happened. Check how long the site was down and what your host did to help. Note which steps worked and which were slow. Update your one page plan with anything you learned.
It also helps to review your traffic and search data in the weeks after. Tracking the right metrics to evaluate the effectiveness of your SEO makes it easier to spot unusual drops. A short outage will often pass with little lasting effect. A long or repeated one is a good reason to rethink your hosting.
Frequently asked questions
Is a denial of service attack the same as being hacked?
Not quite. A denial of service attack aims to stop people reaching your site. It does not have to involve anyone getting into your files or data. Even so, it is a security incident and worth treating seriously.
Can a small business really be targeted?
Yes. The ASD notes that organisations cannot fully avoid being targeted. Attackers can rent botnets, which lowers the effort involved. That is why preparation matters for sites of every size.
What is the cheapest way to prepare?
Start by asking your host what protection your plan includes. Then write down who to contact and what you would switch off. A simple static page and an uptime alert cost very little. These small steps make a real difference on the day.
Should I report an attack?
The ASD recommends reporting attacks to the relevant authorities. In Australia that means contacting the ASD through cyber.gov.au. Your host may also want to know straight away. Keep notes of times and symptoms to help with any report.
This article is general information only. Speak with your hosting provider or a qualified security professional about protection for your own website.