DDoS-aanval op je website herkennen en aanpakken

Your website suddenly loads slowly, shows a 503 error or is not reachable at all. You haven't changed anything, there was no update, and yet your customers are staring at a blank screen. A DDoS attack on your website is one of the things that could be going on.

A DDoS attack (Distributed Denial of Service) means a large group of computers hits your site at the same time, so the server can't keep up. It is not a break-in. Nothing is stolen, the door is simply blocked by thousands of people at once. Below you can read how to recognise it, what to do in the first hour and what makes sure it doesn't hit as hard next time.

How do you recognise a DDoS attack on your website?

A single signal says little. A slow site can also be caused by a heavy plugin. But when several things happen at once, especially if they start suddenly, it becomes suspicious. Watch for these signals:

• Your site is suddenly slow or unreachable, even on pages that normally load very fast, such as your contact page.
• 503 errors (Service Unavailable) or timeouts. The server is telling you it can't cope right now.
• A spike in your traffic for no clear reason. No newsletter, no ad, no mention anywhere.
• Visitors who all do the same thing: thousands of requests to the same page, or to your login page, search function or cart.
• Traffic from countries where you have no customers, or a stream of visitors with almost identical browser details.
• Your email or other services on the same server also stall.
• A message from your host saying unusually high traffic is coming in or your server is overloaded.

You can see this in the statistics or log files of your hosting. If you don't know where to look, ask your host. They can usually tell within minutes whether it is an attack.

DDoS or just busy? How to tell the difference

Not every spike is an attack. A successful promotion or a TV mention also brings many visitors suddenly. The difference is in the pattern.

A small caveat: a broken plugin, a script stuck in a loop or a search engine bot that crawls too eagerly can also bring your server down. It looks like an attack, but it is self-inflicted. That is why the first step is always to look at what is coming in.

What do you do right away during a DDoS attack?

You don't need to be a techie to take the first steps. This is an order that works:

1. Call or email your host. Say that you suspect an attack, since when it has been going on and which pages are affected. A good host can filter traffic at network level, and you can't do that yourself.
2. Don't blindly switch everything off and on again. Restarting the server gives you a moment of relief at best. The attack simply continues.
3. Check whether it is really an attack. See if anything changed recently: a new plugin, an update, a campaign. This rules out self-inflicted problems.
4. Set limits per visitor. With rate limiting, you decide how many requests a single address may make per minute. You can read how that works in our article on rate limiting and custom limits per address.
5. Block suspicious addresses, but don't expect much from it. In a real DDoS attack, the requests come from so many different addresses that blocking them by hand is like mopping the floor with the tap still running.
6. Inform your customers. A short message on social media or by email (“our site is having an outage, we are working on it”) saves phone calls and protects trust.
7. Keep evidence. Take screenshots of statistics and keep log files. You need them if you want to file a report or an insurer wants to see them.

What if money is demanded?

Sometimes a message arrives during or just after an attack saying it will stop if you pay. Do not pay. There is no guarantee it will stop, and it shows that you pay. Keep the message, report it to your host and consider filing a report.

What a DDoS attack does to your business

The damage is rarely in the attack itself, but in what doesn't happen during the outage. A web shop that is offline for an afternoon loses orders. A service provider with an unreachable site misses enquiries. Search engines notice too: if your site is down often, that won't help your visibility.

Some attackers also use the chaos as a smokescreen. While everyone is looking at the slow site, something else is being tried elsewhere, such as logging in with stolen passwords. So after an attack, also check that nothing has changed on your site. If your WordPress site looks strange, our article hacked website: what to do in the first 24 hours can help.

Which protection prevents a DDoS attack?

You can't stop an attack by making your own server stronger. An attack can always be bigger than your server. What does work is catching and filtering the traffic before it reaches your server. That comes in a few layers:

• Filtering at network level. Junk traffic is removed before it hits your website. With a good host, this is included as standard. At Netslim, anti-DDoS protection is included with your hosting as standard, on servers in ISO 27001 data centres in Germany.
• Protection at the edge of your site. A layer between visitor and server recognises bots and unnatural behaviour and lets real visitors through.
• Rate limiting. A visitor who requests hundreds of pages in a few seconds is not a visitor. You slow them down.
• Caching. Pages that are already prepared don't have to be rebuilt for every request. That lowers the load considerably, even on ordinary busy days.
• Monitor your site. The sooner you notice something is wrong, the faster you can act. An alert by email or text message during an outage, as with Serverwacht, saves you hours of not knowing.

Your own server or VPS without filtering is the most vulnerable. You carry the full load yourself, and a relatively small attack can be enough to take you offline.

What to do now

If your site is down right now, start at step 1 above and contact your host. If it's quiet, use that time:

1. Run the free website check. You see how fast your site is and whether your security headers are correct, so you know where you stand before things go wrong.
2. Ask your host what DDoS protection is included as standard, and at what point they step in. If you don't get a clear answer, that is also an answer.
3. Turn on an uptime alert, so you are the first to know and not your customer.
4. Decide in advance who does what when the site is down: who calls the host, who informs customers. It takes a quarter of an hour and saves panic.

If you want the protection simply taken care of, it comes standard with our web hosting. Then you don't have to think about it yourself, and during an attack someone who does this daily is watching along.

Frequently asked questions

How long does a DDoS attack usually last?

That varies a lot. Some attacks last only a few minutes, others continue for hours or days, sometimes with pauses in between. You can't predict the duration, so it makes sense to have protection before it starts.

Is a DDoS attack a criminal offence?

Yes, deliberately making someone else's website unreachable is a criminal offence in the Netherlands. You can file a report. Keep screenshots and log files from the moment it happened.

Can hackers steal data through a DDoS attack?

They don't steal anything with it themselves, because the attack only overloads your server. Sometimes it is used as a distraction while something else is tried elsewhere. So after an attack, also check your admin accounts and files.

Why would anyone attack my small website?

Often it isn't personal. Reasons range from a conflict or an extortion attempt to a competitor, a gamer with a grudge or an attacker practising. Small sites get hit too, because they are less protected.