What is a DDoS attack, and how does it take a website down?

Most outages are accidents: a bad update, a failed server, an expired certificate. A smaller number are deliberate. A distributed denial-of-service attack, usually shortened to DDoS, tries to make a website or service unusable by flooding it with more traffic than it can handle. This guide explains what that means and what it looks like from the outside.

The idea in one picture

Imagine a shop with one door. On a normal day customers come in a few at a time. Now imagine thousands of people crowd the doorway at once, none of whom want to buy anything. Real customers cannot get in, and the staff cannot serve anyone. The shop has not been broken into and nothing has been stolen, but it is effectively closed. A denial-of-service attack does the same to a server.

The “distributed” part means the traffic comes from a very large number of machines at once, often hundreds of thousands, which makes it hard to block by simply banning one address. The machines are usually ordinary devices such as poorly secured home routers, cameras or computers that have been taken over without their owners knowing.

The main kinds of attack

  • Volume attacks. These try to fill the network link in front of a site with junk, so real requests cannot get through. Think of a motorway blocked by sheer numbers of cars.
  • Protocol attacks. These abuse the way connections are set up, for example by starting huge numbers of connections and never finishing them, so a server or firewall runs out of room to track them.
  • Application attacks. These look like normal visitors but ask for the most expensive things a site can do, such as a search or a login, again and again. They need much less traffic to cause trouble because each request costs the server real work.

Why it causes an outage

Every server, network link and database has a limit. A DDoS tries to push one of those limits past breaking point. When it works, the symptoms people see are the same as any overload: pages that load very slowly, time out, or return errors such as 503 Service Unavailable. The site’s own data is normally untouched. A denial of service is about availability, not theft, although attackers sometimes use one as a distraction while they try something else.

How websites defend themselves

  • Absorbing the traffic. Large providers run networks with far more capacity than any single attack. A content delivery network spreads requests across many locations, so the flood is diluted rather than aimed at one machine.
  • Filtering. Systems look at traffic patterns and drop requests that look like part of an attack, while letting real visitors through. This is why you may occasionally be asked to prove you are human.
  • Rate limiting. Capping how many requests one address or one account can make in a short time stops a single source from using up the whole site.
  • Scaling and redundancy. Running several servers behind a load balancer means one overloaded machine does not take everything with it. See also how websites stay up.

How to tell whether an outage might be an attack

From outside, you usually cannot. A flood and a failed server look alike: slow pages, timeouts, error messages. A few clues help. An attack tends to start abruptly, may hit one site rather than a whole provider, and is often described by the company as “unusually high traffic” or “a denial of service incident”. Companies sometimes avoid saying so at first, because the cause takes time to confirm. Treat a cause as unknown until the site itself reports it. Our State of the internet page shows whether many sites are affected at once, which points to a shared provider rather than a targeted attack.

What you can do as a visitor

There is little you can do to help a site under attack, and nothing you need to fix on your side. Check that it is down for others with the website checker, wait, and follow the company’s status page or social account for updates (see what to do when a service is down). Do not repeatedly refresh, since that adds a little to the load, and be wary of messages claiming to be from the company that ask you to log in or pay to “restore access”. Those are scams that tend to appear during any well-publicised outage.

What it means for site owners

If you run a site, the best protection is boring and done in advance: put it behind a content delivery network or protection service, keep your own server address private, make expensive pages cheap with caching, and set up monitoring so you know the moment it slows. Decide beforehand who to contact at your host, and how you will tell your users, using a plain update such as the ones described in how to write an outage update.

We describe general concepts here. We cannot tell from our own checks whether any particular outage was an attack, and we never claim to.

Check a website now

Is it down for everyone, or just you? Paste an address and we test it from fifteen places.

Open the checker

Related guides

Last updated 2 November 2026. Written by the siteupdown.com team. Spotted a mistake?

← All help guides