Most small business websites don't need a paid DDoS protection service, but they do benefit from a basic layer that costs little or nothing. Putting your site behind a CDN that includes DDoS mitigation, as Cloudflare's free plan and many hosts do, absorbs common attacks. Pay for more only if downtime costs you serious money or you're a likely target.
This guide explains what a DDoS attack is, how likely one is for a small business, what your host already covers, and a proportionate plan for staying online.
Key takeaways
- Most small business websites do not need a paid DDoS service, but a free CDN layer with built-in mitigation absorbs common attacks.
- Many hosts filter large network floods but not application-layer floods, so ask yours what is covered and whether sites get null-routed.
- Hide your origin server, cache as much as possible and rate limit expensive pages such as login, search and checkout.
- Pay for advanced protection only if an hour of downtime costs more than a year of protection or you have already been attacked.
What is a DDoS attack?
A distributed denial of service (DDoS) attack floods a website or server with so much traffic, or so many expensive requests, that genuine visitors can't get through. "Distributed" means the traffic comes from many machines at once, typically hijacked devices in a botnet, so blocking a single IP address doesn't help.
There are two broad kinds:
| Type | Layer | What it targets | Example |
|---|---|---|---|
| Volumetric / network | Layers 3 and 4 | Bandwidth and network equipment | UDP floods, reflection attacks |
| Application | Layer 7 | Your web server, PHP and database | Thousands of requests per second to search, login or checkout pages |
Small sites are most often knocked over by the second kind, because a cheap shared hosting plan can be overwhelmed by a modest number of requests to an uncached page.
Are small businesses actually targeted by DDoS attacks?
Less often than by phishing, account takeover or vulnerable plugins, but it does happen. Typical reasons include:
- Extortion: a demand for payment to stop an attack, often timed around a busy sales period.
- Grudges and competition: disgruntled customers, former staff or rivals renting cheap "booter" services.
- Hacktivism: in January 2026 the UK's National Cyber Security Centre (NCSC) warned that Russian-aligned hacktivist groups were continuing to target UK organisations with denial of service attacks, particularly local government and critical infrastructure. It noted that "although denial-of-service attacks may be technically simple, their impact can be significant."
- Collateral damage: on shared hosting, an attack on another customer can slow your site too.
Remember too that your site can be knocked offline by perfectly legitimate traffic, such as a TV mention or a viral post, or by aggressive crawlers. The defences below help in both cases.
Does my web host already protect me from DDoS?
Often partly. Most reputable hosts filter large network-level floods at their data centre edge, because those attacks threaten all their customers. What they usually don't do is protect your individual site from application-layer floods, and some will null-route (temporarily disconnect) a site under heavy attack to protect everyone else.
Ask your host:
- Do you filter volumetric DDoS attacks, and is it included in my plan?
- Do you protect against application-layer (HTTP) floods?
- What happens to my site during an attack: is it null-routed?
- Is there a bandwidth cap or overage charge if traffic spikes?
The NCSC's guidance makes the same point: understand which parts of your service you're responsible for and which sit with a supplier, and check whether your provider will throttle your bandwidth beyond a certain level.
What free or cheap DDoS protection is available?
The most cost-effective step is putting your site behind a CDN or reverse proxy with built-in mitigation. Cloudflare, for example, includes "standard, unmetered DDoS protection (layers 3-7)" on every plan, including Free. Other CDNs and several hosting platforms offer similar protection, sometimes bundled with their WAF.
A CDN helps in three ways:
- Absorbs volume across a large global network instead of your single server.
- Caches pages, so most requests never reach your origin.
- Filters and challenges suspicious traffic before it arrives.
To make it effective:
- Proxy all public web records through the CDN.
- Cache as much as possible, including full HTML for pages that don't change per visitor.
- Hide your origin: restrict it to accept web traffic only from the CDN's IP ranges, and don't leave old DNS records (such as a
direct.subdomain) pointing to the real server IP. - Add rate limits to expensive endpoints such as login, search, basket and contact forms.
- Learn where your provider's emergency switch is, such as Cloudflare's "Under Attack" mode, which challenges every visitor while an attack is ongoing.
Our guide on whether you need a CDN covers the performance side of the same decision.
When should a small business pay for advanced DDoS protection?
Consider a paid tier or specialist service if:
- An hour of downtime costs you more than the protection would cost in a year, for example a busy e-commerce shop on Black Friday or a ticketing site on launch day.
- You've already been attacked or received an extortion demand.
- You run services beyond a website, such as game servers, VoIP or APIs that can't sit behind a standard web CDN.
- Customers or contracts require a specific availability commitment.
Paid tiers typically add finer-grained rate limiting, bot management, faster support during an incident and service-level guarantees.
How should I prepare for a DDoS attack?
The NCSC sets out five practices: understand your service, use upstream defences, plan for scaling, have a response plan and test and monitor. It is also candid that "it is not possible to fully mitigate the risk of a denial of service attack affecting your service". In the US, the joint CISA, FBI and MS-ISAC guide Understanding and Responding to Distributed Denial-of-Service Attacks covers similar ground. For a small business, that translates into:
- Know your weak points. Which pages are uncached and hit the database hardest?
- Put defences upstream with a CDN and confirm what your host filters.
- Make the site light, with caching and a fast server response, so it can handle spikes. Our guide to reducing TTFB helps here.
- Write a one-page plan: who to call at your host and CDN, how to enable emergency mode, how to tell customers (social media, email), and where admin logins live if the site is unreachable.
- Monitor. Use an uptime monitor that alerts you within minutes, and keep an eye on your CDN's traffic analytics.
- Never pay a ransom demand. Report extortion to Report Fraud (England, Wales and Northern Ireland) or Police Scotland on 101.
What to do next
Check what your host includes, then put a free CDN layer in front of your site and lock your origin down to it. Use an external uptime monitor so you know about an outage within minutes. MakeItFlow doesn't monitor uptime or block attacks, but its free website security scan checks the HTTPS, headers and exposed files that matter once your site sits behind a CDN, and its DNS health check helps you spot records that might reveal your origin. Then run a free MakeItFlow website audit to see where caching and speed could help you ride out a spike.
Frequently asked questions
Can a DDoS attack steal my data?
Not by itself. A DDoS attack aims to make your site unavailable, not to break in. Occasionally attackers use one as a distraction, so check logs for other suspicious activity afterwards.
How do I know if my site is under a DDoS attack?
Signs include a sudden, sustained traffic spike from many sources, very slow pages or timeouts, and your host reporting resource limits being hit. Your CDN or host analytics will show whether the traffic is genuine visitors or a flood.
Will a DDoS attack affect my Google rankings?
A short outage generally won't. Extended or repeated downtime can lead Google to crawl less and, eventually, drop pages that keep returning errors, so restoring service quickly matters.
Is DDoS protection included with website builders?
Large hosted platforms generally protect their own infrastructure, which covers the sites on it. Check their status page and terms if uptime is critical to your business.
Is a WAF the same as DDoS protection?
No, but they overlap. A WAF filters malicious requests such as injection attacks; DDoS protection absorbs floods of traffic. Many CDNs bundle both.
Related reading
- Cyber Essentials 2026 Changes: What UK Small Businesses Need: Cyber Essentials v3.3 took effect in April 2026 with automatic fails for missing MFA and slow patching. What UK businesses with websites need to check now.
- WordPress 7.1.3 Security Release: What Site Owners Should Check: WordPress 7.1.3, released on 6 October 2026, fixes seven security issues including stored XSS and SQL injection. What site owners should check and update.
- Post-Quantum Encryption for Websites: What Small Businesses Need: Post-quantum encryption for websites: harvest now, decrypt later, hybrid X25519MLKEM768 key exchange, NCSC timelines and the steps a small business needs.
- What Is a Web Application Firewall and Do I Need One?: A web application firewall (WAF) blocks malicious requests such as SQL injection and bad bots before they reach your site. See if you need one and free options.
Sources
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above and this guide was last reviewed on 25 October 2026 . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
