Last updated: 30 October 2026
A denial of service (DoS) attack tries to make a website, server or network unusable by overloading it. When the traffic comes from many machines at once it is a distributed denial of service (DDoS) attack, which produces more traffic and is harder to tell apart from real users. This guide explains the common attack types, the warning signs, and how to prepare, using the UK National Cyber Security Centre (NCSC) guidance as the baseline.
- What it is: an attempt to degrade or block a service by exhausting bandwidth or server processing capacity.
- Warning signs: the site or service becomes very slow or unreachable for everyone, not just one user.
- What helps: know your service, use upstream protection, plan for scaling, keep a written response plan, and test it.
In this guide
Common attack types
Attacks are usually grouped by what they exhaust. A single attack can combine several.
| Type | Target | Example |
|---|---|---|
| Volumetric | Network bandwidth | Floods of packets or amplified responses that fill the link |
| Protocol | Connection tables, firewalls, load balancers | SYN floods that leave connections half-open |
| Application layer | Web server or application processing | Many expensive HTTP requests, such as repeated searches or logins |
Signs of an attack
- Pages load very slowly or time out for many users at the same time.
- Traffic jumps sharply, often from many unrelated addresses, or from one address making huge numbers of requests.
- Servers or firewalls hit CPU, memory or connection limits with no matching business reason.
- Monitoring shows one URL or one service being hit far harder than the rest.
Slowness can also come from a successful marketing campaign, a bad deployment or a failing disk, so compare with change logs and normal traffic first.
Prepare your defences
The NCSC guidance sets out four practices:
- Understand your service. List what you run, what it depends on (DNS, payment, login, third-party APIs), and which parts are business critical.
- Understand your defences. Use protection applied upstream, before traffic reaches your own servers, such as your internet provider, a content delivery network or a DDoS protection service.
- Plan for scaling. Make sure you can add capacity quickly to absorb extra load.
- Create and test a response plan. Write down who does what, who to call at your provider, and how you communicate with customers. Test it, and monitor so you notice attacks early.
If an attack starts
- Confirm it is an attack by checking traffic graphs, logs and recent changes.
- Contact your internet provider or DDoS protection provider and share timestamps, target addresses and traffic samples.
- Apply rate limits or blocks at the edge for clearly abusive sources, but avoid blocking real customers.
- Keep non-essential services and heavy pages switched off or cached until traffic returns to normal.
- Record what happened and review your plan afterwards. Report serious attacks to your national cyber authority.
FAQ
Is a DoS attack the same as a hack?
No. A DoS attack disrupts availability. It does not by itself steal or change data, although attackers sometimes use it as a distraction.
Can I stop a DDoS attack on my own server?
Rarely. If the link is full, traffic must be filtered before it reaches you, which is why upstream protection matters.
Why would anyone attack a small site?
Reasons include extortion, competition, grudges and testing tools. Small sites on shared infrastructure can also be hit as collateral damage.
Sources
More on this site: Security guides · All IT guides
Thank you for your message.