A denial-of-service attack tries to make a service unavailable. When many systems take part, it is usually called a distributed denial-of-service attack, or DDoS. The visible result may be a slow website, failed requests, or a complete outage, but different causes need different responses.
Understand the idea
Find the bottleneck before choosing a control. A traffic flood can fill the connection to the provider. A smaller number of expensive requests can exhaust the application instead. A firewall rule at the website cannot recover bandwidth already consumed upstream, while an application change may help an overloaded feature.
- Link
Check upstream traffic and network capacity.
- Application
Check request patterns and backend resource pressure.
- Mitigation
Coordinate controls at the affected layer and verify service recovery.
A practical example
Imagine a donation page slowing during a campaign. Monitoring shows that one search feature is consuming the available server resources. The team works with the hosting provider and applies a focused limit while checking that ordinary donors can still complete payments.
What to do next
- Confirm the failing resource. Measure bandwidth, connection queues, application latency, and database pressure.
- Engage the right provider. Upstream saturation generally needs upstream help; an application rule cannot recover a network link already overwhelmed before traffic reaches it.
- Apply targeted limits. Use route, identity, behavior, and capacity signals where possible. A blanket IP ban can affect many legitimate users behind a shared network.
- Protect critical journeys. Prefer a documented degraded mode over uncontrolled failure. Watch error rates, customer access, and cost as controls change.
How to check the result
Watch both technical health and the real user task. A drop in requests is not a complete success measure if legitimate users are also blocked from the service.
The bandwidth graph looks normal, but users cannot sign in.
Inspect application latency, expensive endpoints, and dependent services. An application-layer attack can overload a specific workflow without saturating the internet link.
Sources and useful guides
The following resources provide background and more detailed guidance. Use the sections that match your service and situation.
