TL;DR:
- DDoS attacks flood your website or internet connection with traffic to knock it offline, and small businesses are targeted more than most people realise
- The most common small business DDoS is extortion: pay up or your site stays down
- Free and affordable DDoS protection (Cloudflare, your hosting provider’s built-in mitigation) is available and should be enabled before an attack happens, not after
Most small business owners assume DDoS attacks are something that happens to banks and governments. In reality, UK small businesses face DDoS attacks regularly, often from automated attack-for-hire services that cost an attacker as little as a few pounds per hour. The disruption they cause, whether to your website, online orders, or VoIP phone system, can cost far more.
What Is a DDoS Attack?
A Distributed Denial-of-Service attack sends so much traffic to your internet-connected services that they become overwhelmed and stop responding to legitimate users. The “distributed” part means the traffic comes from many sources simultaneously, often from thousands of infected devices (a botnet) spread around the world, which makes blocking it by IP address impractical.
There are three main types:
Volumetric attacks flood your connection with raw data, consuming all available bandwidth. Your site goes offline for everyone because there’s no room for real traffic.
Protocol attacks exploit weaknesses in networking protocols (TCP, UDP, ICMP) to exhaust the capacity of servers or network devices without necessarily maxing out bandwidth.
Application layer attacks (Layer 7) target specific pages or services on your website with requests that look legitimate but are designed to consume server resources, such as hitting a heavy search page repeatedly.
Why Would Someone Attack a Small Business?
Extortion. This is the most common motive for small business DDoS attacks. You receive a message demanding payment (often in cryptocurrency) to stop the attack. The attacker is betting that a day offline costs you more than the ransom.
Competitive disruption. Uncommon but documented: a competitor uses a cheap DDoS-for-hire service to knock your site offline during a busy period, such as a sale event or product launch.
Ideological reasons. If your business has taken a public political or social stance that someone disagrees with, activist groups occasionally use DDoS as a form of protest.
Accidental targeting. Your hosting provider’s IP address range might be the real target, and your site is caught in the crossfire.
Signs You’re Being DDoS’d
A DDoS attack looks a lot like a server overload from unexpected traffic, which can make it confusing to diagnose. Signs include:
- Your website becomes unavailable or extremely slow suddenly and without a visible cause
- Your internet connection slows down or drops for everyone in your office, not just web visitors
- Your hosting provider or ISP contacts you about unusual traffic volumes
- Your server monitoring shows CPU, memory, or bandwidth near 100% without a corresponding spike in legitimate activity
If you use Cloudflare or a similar CDN, check its security dashboard, unusual firewall block counts or traffic spikes from unexpected geographic locations are characteristic of an attack.
What to Do During an Attack
Contact your hosting provider immediately. Many hosts have upstream DDoS mitigation they can activate. Tell them you believe you’re under attack and ask what protection they can enable. Response time matters.
Enable Cloudflare or your CDN’s “Under Attack Mode” if you have it configured. This enables JavaScript challenges for all visitors, which blocks bots while letting real users through with a few seconds’ delay.
Don’t pay the ransom. Payment does not guarantee the attack stops. It confirms you’re willing to pay and may result in repeat demands. Report to Action Fraud (actionfraud.police.uk, 0300 123 2040) and the NCSC (report.ncsc.gov.uk).
Document everything. Screenshot attack notifications, note timestamps, save logs. This matters for insurance claims and any potential law enforcement investigation.
Check your VoIP. If your business phones run over the internet (VoIP), a volumetric DDoS that saturates your connection will knock out your phones too. Have a mobile fallback number your team can use.
How to Protect Yourself Before an Attack
Put your website behind Cloudflare. Cloudflare’s free plan includes significant DDoS protection for websites. Your website’s traffic routes through Cloudflare’s network, which absorbs attack traffic before it reaches your server. Setting this up takes around 30 minutes: create a Cloudflare account, add your domain, and update your domain’s nameservers. Do this now, not when you’re already under attack.
Ask your hosting provider what DDoS mitigation they include. Many UK hosts include basic DDoS protection by default. Find out the scale of attacks they can mitigate and what happens if you’re targeted by something larger.
Harden your login pages. Application-layer attacks often target login pages and search functionality. Rate-limiting login attempts and enabling CAPTCHA on high-load pages reduces the impact of these.
Have a communication plan. If your site goes offline, how will customers reach you? Make sure your phone number is publicly visible, keep your Google Business Profile updated, and have a message ready to post on social media explaining the situation.
Check your cyber insurance. Some cyber insurance policies cover DDoS-related business interruption losses and the cost of mitigation. Check whether yours does before you need to claim.
Costs and Reality Check
For most small businesses, the right level of DDoS protection is:
- Cloudflare free plan (or paid if you need guaranteed uptime SLAs) - protects your website
- Hosting provider’s included mitigation - protects your server
- ISP-level filtering (ask your ISP what they offer) - protects your connection
This combination handles the vast majority of small business DDoS attacks. Larger volumetric attacks targeting major infrastructure require specialist mitigation services, but those are not the typical threat profile for a small business.
The most important thing is to have protection in place before an attack happens. Enabling Cloudflare in the middle of an active attack is possible but takes time, during which your site is still down.