Traffic flood

A denial-of-service (DoS) attack tries to make a website slow or unavailable by sending far more requests than it can handle. When the requests come from many machines at once, it is a distributed denial-of-service (DDoS) attack.

The goal is rarely to steal data. It is to take the site offline, to extort the owner, or to distract from another attack.

1. The attacker controls many machines, often infected devices, or rents a service that sends the traffic.
2. These machines send a flood of requests at your website or at the server and network behind it.
3. Your server or its bandwidth runs out, and real visitors get errors or slow pages.
4. Some attacks send huge volumes of raw network traffic; others send ordinary-looking page requests that are expensive for your site to answer.

• Sudden extreme slowness or errors with no change on your side.
• A large jump in requests, often to the same page or to search and login pages.
• Many requests from one address, or from a huge number of addresses at once.
• Your hosting provider warning you about unusual traffic.

• Lost sales and trust while the site is down.
• Higher hosting bills from sudden traffic.
• Real visitors locked out.
• A distraction while a different attack takes place.

• Put the site behind a CDN or protection service that filters floods before they reach your server, such as Cloudflare, Fastly or AWS CloudFront and Shield. This is what actually stops large attacks.
• Use the firewall or rate-limit features of your hosting platform.
• Cache pages that rarely change, so a flood hits the cache rather than your server.
• Keep your origin server's address private where possible.
• Set per-IP rate limits for expensive pages such as search and login.
• Prepare a plan: who to call, what to switch on, and how to tell customers.

Not sure how your own site looks from outside? Run the free website security scanner.

Rakshak counts the requests that reach your website from each IP address. When a single IP address sends an unusually large number of requests within a minute, it raises a critical traffic-flood alert.

• Every detection creates an alert in your Rakshak dashboard with the IP address, the request that triggered it, the severity and the time.
• If you have connected Telegram, Rakshak also sends you a message. You choose which severities you want to be told about.
• Repeated alerts of the same type from the same IP address are grouped for ten minutes, so you are not flooded with duplicates.
• Traffic flood is a critical-severity detection, so Rakshak automatically adds the offending IP address to your blocklist. With the Rakshak server middleware installed, that visitor then sees an "Access denied" page instead of your website.
• Blocking needs the Rakshak server middleware on your website. The lightweight browser snippet can detect and alert, but a browser script cannot block a visitor.

A website has an expensive search page. One IP address starts requesting it hundreds of times a minute, and the site slows down.

Rakshak sees far more requests than normal from that single address, raises a critical traffic-flood alert and (with the middleware installed) adds the address to the blocklist, so its further requests get an "Access denied" page.

A flood from thousands of addresses would look different: no single address would stand out. For that, the owner relies on the CDN in front of the site.

GET /search?q=...   (hundreds of requests within one minute from the same IP address)

Does Rakshak protect my site from DDoS attacks?

Not in the sense of absorbing or filtering a large attack. Rakshak detects floods from a single IP address, alerts you and can block that address. Protection against large, distributed attacks needs a CDN or DDoS protection service.

What is the difference between DoS and DDoS?

A DoS attack comes from one source. A DDoS attack comes from many sources at once, which makes it much harder to block by address.

Will an automatic block ever hit a real visitor?

It can, if a real visitor or a shared network sends a very large number of requests. You can review blocked addresses on the IP management page and unblock any of them.

What should I do during an attack?

Contact your hosting or CDN provider, switch on their protection mode, rate-limit expensive pages, and keep a record of times and addresses for later.

Can a small website be a target?

Yes. Small sites are attacked for extortion, by competitors, or simply because they are easy to reach. A CDN with a free tier is a sensible first step.