DDoS defence: how to protect a website
A DDoS attack floods your site with fake traffic. You cannot out-scale it alone, but layered defences make it survivable.
A DDoS (distributed denial of service) attack uses many machines to flood a target so real users cannot get in. Defence is about absorbing, filtering and hiding.
Types of attack
- Volumetric: floods of data (UDP, DNS or NTP amplification) that fill your network pipe. Measured in Gbps.
- Protocol: abuse of network protocols to exhaust servers or firewalls, such as SYN floods.
- Application layer (L7): many real-looking HTTP requests to expensive pages (search, login, an API). Low volume but very effective, because each request costs your server a lot.
Layer 1: absorb at the edge
A large CDN / DDoS protection provider (such as Cloudflare or similar) has more network capacity than any single site and uses anycast, so attack traffic is spread over many locations. Put your site behind it, so floods are absorbed before reaching you. You cannot beat a big attack from one server or a small VPS.
Layer 2: hide the origin
If attackers learn your server's real IP, they can bypass the CDN. So:
- Allow connections to the origin only from the CDN's IP ranges (firewall), or use a tunnel from the origin to the CDN.
- Do not leak the IP through old DNS records, email headers or subdomains that skip the CDN.
Layer 3: cache and rate limit
- Cache as much as possible (static files, public pages). A cache hit costs almost nothing.
- Rate limit per IP, per session and per expensive endpoint (login, search, password reset).
- Make expensive operations cheaper, or move them behind a login or a challenge.
Layer 4: filter smartly
- A WAF blocks known bad patterns.
- Bot detection and challenges (JavaScript or CAPTCHA-style checks) for suspicious clients.
- Block or challenge by country or ASN only if your users allow it, and with care.
Layer 5: be ready
- Autoscaling is not a full answer. It can raise your cloud bill during an attack and may simply scale up to serve the attacker. Set spending alerts and caps.
- Keep a runbook: who to contact, how to turn on "under attack" mode, how to see traffic, how to communicate on a status page.
- Monitor for sudden jumps in traffic, errors and latency, so you notice early.
- Keep your DNS with a provider that can absorb attacks as well.
What to avoid
Do not rely on hiding behind a rarely-known URL. Do not expose admin panels publicly. Do not forget that attacks can also target weak points like login or search.
Takeaway: put your site behind a large edge network, protect the origin IP, cache and rate limit, and have a ready plan.
System Design series, Part 5 (failure and security): 4 of 6. Previous: How to write a blameless postmortem.
