DDoS and abuse: what to do when you are attacked
Recognise an attack, mitigate it with the layers you already have, and know when to ask for help.
Attacks come in a few flavours, and the response differs for each.
Recognise what you are facing
Volumetric — a flood of traffic saturating bandwidth. The whole site is unreachable.
Application-layer — many expensive requests (search, login, uncached pages). Traffic looks normal; the server is exhausted.
Brute-force — repeated login/SSH attempts. Slow and continuous.
Scraping / bot abuse — not always malicious, but it consumes bandwidth and CPU.
Check the panel's traffic graphs and your logs: a sudden flood or a flood of similar requests tells you which one it is.
Mitigate with layers you already have
A CDN/WAF in front absorbs volumetric attacks and filters obvious bad traffic at the edge. This is the single most effective layer for a small operation.
Rate limiting at the web server or proxy, per IP and per path, tames application-layer floods.
Caching makes expensive pages cheap, so a flood of them costs far less.
fail2ban / CrowdSec block repeated offenders automatically — guide.
Firewall rules to drop obviously hostile source ranges (carefully — do not block whole countries unless that is genuinely your policy).
Turn off what you do not need. Every open port is an entry point.
Do not block your customers
Mitigation has its own risk. Rate limits that are too tight block legitimate users; broad IP bans lock out regions. Tighten incrementally and watch the impact.
Brute-force specifically
SSH — keys only, fail2ban, and ideally not exposed publicly at all.
Logins — rate limit per IP and per account, add CAPTCHA and 2FA, and lock accounts after repeated failures.
APIs — per-key rate limits and quotas.
When to ask for help
If traffic is saturating the network itself (not just your app), that is an infrastructure problem — open a ticket immediately with the traffic graphs and the times it started. We can help filter upstream and advise on the right layer.
After the attack
Review what worked and what did not; tighten the gaps.
Keep the mitigating layers in place — attackers retry.
Do not assume it was personal; most attacks are automated and indiscriminate.
Related reading