What Is a DDoS Attack and How Can You Defend Against One?
Most security threats are about stealing or manipulating data quietly. A DDoS attack has a completely different goal: taking your service offline, loudly and immediately, by overwhelming it with traffic until legitimate users simply can't get through.
What DDoS actually stands for, and means
DDoS stands for "distributed denial of service." Denial of service just means making a service unavailable to its real users. "Distributed" is the important part — instead of one attacking machine, a real DDoS attack comes from thousands or even millions of devices at once, usually a "botnet" of compromised computers, routers, or IoT devices that an attacker controls without their owners' knowledge. Distributing the attack this way makes it dramatically harder to stop, because you can't just block one source — the traffic is coming from everywhere.
The common forms it takes
- Volumetric attacks. Simply flooding your network connection with an enormous amount of junk traffic until there's no bandwidth left for real requests to get through at all.
- Protocol attacks. Exploiting weaknesses in how network protocols handle connections — for example, opening huge numbers of connections and never completing them properly, exhausting server resources that were waiting on those responses.
- Application-layer attacks. The most sophisticated category — sending requests that look like completely normal user traffic, but at a volume designed to overwhelm your application's actual processing capacity rather than the raw network pipe. These are the hardest to distinguish from a genuine, unexpected spike in real user traffic.
Why these attacks happen
Motives vary widely: extortion (pay us or the attack continues), competitive sabotage, activism directed at a company's public actions, or occasionally no clear motive at all beyond causing disruption. The business impact is the same regardless of motive — real revenue loss for every minute your service is unreachable, reputational damage, and in some industries, real contractual or compliance consequences tied to uptime commitments.
Defenses that actually work
A content delivery network with DDoS protection
Services like Cloudflare sit in front of your actual servers and absorb traffic before it ever reaches your infrastructure — they have the scale to handle floods that would take a typical server down instantly, and they distinguish attack traffic from real traffic at that scale far better than most companies could do on their own.
Rate limiting and traffic filtering
Setting sensible limits on how many requests a single source can make in a given window, so no single client — automated or not — can overwhelm your application layer on its own, whether that traffic turns out to be malicious or just an unexpected surge.
Scalable infrastructure
Infrastructure that can scale up automatically under load buys real time and headroom during an attack, and helps distinguish a genuine traffic spike from real users versus a coordinated flood — though scaling alone isn't a complete defense against a large, determined attack on its own.
A real incident response plan
Knowing in advance exactly who gets alerted, what steps get taken, and who has authority to make infrastructure changes under pressure turns an active DDoS attack from chaos into a rehearsed, manageable process — the difference between a five-minute blip and a multi-hour outage often comes down entirely to how prepared the response was, not how strong the attack was.
A practical starting point
Most businesses don't need enterprise-grade, specialized DDoS mitigation from day one. A CDN with built-in DDoS protection, sensible rate limiting at the application level, and infrastructure that can scale under load covers the overwhelming majority of realistic scenarios. The bigger gap in most companies isn't the tooling — it's not having a plan for what to actually do when an attack happens, worked out in advance rather than improvised in the moment.
Setting up this kind of protection — the right CDN configuration, sensible rate limits, infrastructure that scales cleanly under load — is core to the infrastructure hardening work Burncode does, alongside application security reviews and compliance readiness.