A distributed denial-of-service attack attempts to make a service unavailable by overwhelming some part of its capacity with traffic or requests from multiple sources. That pressure can affect network bandwidth, connection handling or application work.
Cloudflare’s DDoS overview explains the different attack layers. For the website owner, the immediate job is to establish what is failing and coordinate a proportionate response.
Do not diagnose an attack from downtime alone
A deployment error, overloaded query, DNS failure or ordinary traffic spike can produce similar symptoms. Record when the problem started, which hostnames and paths fail, and whether it affects every visitor or only certain networks.
For example, if static images remain available but a search endpoint times out, inspect application and request evidence. If the network is saturated before traffic reaches the application, a plugin inside WordPress cannot solve that bottleneck by itself.
Give the provider useful evidence
- The exact affected hostname and representative URL.
- The incident start time with its time zone.
- Observed status codes, timeouts and changes from normal traffic.
- Which services still work and whether a recent deployment occurred.
- Any existing CDN or protection layer involved in the request path.
Use the provider’s secure support process for sensitive logs. Do not publish access credentials or full customer request data while reporting the incident.
Contain without losing legitimate access
Work with the hosting or network provider on the layer actually under pressure. Application rules may help with abusive request patterns; network saturation may require upstream capacity and filtering. Preserve administrator access and verify that any challenge or block still permits the site’s essential users and integrations.
A blanket block or an unexplained restart can create a second outage. Record the exact temporary change and how to reverse it.
Verify recovery
Check the original failing paths, a representative visitor workflow and current resource behavior. Watch for recurrence and remove temporary restrictions only when the evidence supports doing so.
The hosting troubleshooting checklist helps distinguish other causes. The management guide helps establish who owns monitoring and incident response before the next problem.