A distributed denial-of-service (DDoS) attack tries to take a site offline by sending more traffic than it can handle, usually from thousands of infected devices at once. No single firewall rule stops every DDoS, but knowing the types helps you choose the right protection and react calmly.
Before you start
- No setup is needed to read this guide. Some steps need access to Cloudflare, WHM or your VPS.
- Background on firewall types: what is a firewall.
The three kinds of DDoS
| Type | Example | Where it is stopped |
|---|---|---|
| Volumetric (layer 3/4) | UDP floods, DNS or NTP amplification, many Gbps of junk | Upstream network filtering by the data centre or a scrubbing service |
| Protocol | SYN floods, fragmented packets | Network filtering, kernel SYN cookies, host firewall |
| Application (layer 7) | Thousands of requests per second to a search or login page | WAF, rate limiting, caching, CAPTCHA |
Volumetric attacks must be filtered before they reach your server, because a full network link cannot be fixed by a firewall on the server itself. Application attacks look like real visitors and are filtered by behaviour.
Signs you are under attack
- The site slows down or returns 503/508 errors while normal visitor numbers have not changed.
- Access logs show huge numbers of requests to one URL, often with odd user agents or from many countries.
- On a VPS, CPU or bandwidth jumps suddenly; see monitoring for scans and floods.
Practical protection steps
- Put the site behind a proxy CDN such as Cloudflare, and keep your origin server IP private.
- Cache aggressively. Cached pages cost almost nothing to serve; on MdmHost use LiteSpeed Cache.
- Rate limit expensive URLs such as logins, search and checkout; see Cloudflare rate limiting.
- Challenge suspicious visitors. Server owners can enable LiteSpeed anti-DDoS reCAPTCHA or Imunify360 WebShield.
- Limit connections per IP on servers you manage, for example CSF
CT_LIMITandCONNLIMIT, or nftables limits. - Close unused ports so floods against them are dropped early; see ports a cPanel server needs.
Tip: During an active layer 7 attack, Cloudflare's Under Attack Mode (Overview page) challenges every visitor for a while. Turn it off once the attack ends.
What to do during an attack
- Hosting customers: open a ticket from Support with the domain, the time it started and any log lines you have. Our 24/7 team can see server-level traffic you cannot.
- VPS owners: identify the top IPs with
ss -ntu | awk '{print $6}' | cut -d: -f1 | sort | uniq -c | sort -nr | headand block clear offenders in your firewall. - Do not pay anyone who threatens a DDoS unless you pay; report it instead.