What is a DDoS attack and how can it take down a website?
Published on 2026-10-17 by frfrand
Cómo funciona un ataque de denegación de servicio distribuido, qué síntomas produce y cuáles son las defensas habituales.
Imagine a small cafeteria with five tables. One day, thousands of people arrive at the same time and block the entrance. Even if the employees know how to work, regular customers cannot get in.
A DDoS attack is an attempt to make a service inaccessible by saturating it with traffic from multiple sources. It does not need to steal a password to cause a problem: its main goal is to prevent others from using the service normally.
What do the acronyms DDoS mean?
They come from Distributed Denial of Service, or distributed denial of service. The word distributed means that requests arrive from many computers or points of origin.
In certain attacks, those computers form a network of compromised devices, sometimes called a botnet. In other scenarios, amplification mechanisms or other traffic sources are involved. Not all attacks use exactly the same method.
What happens when they attack a page?
A website has limited resources: connection, server capacity, and time to process requests.
If traffic exceeds what it can handle, legitimate visitors may receive errors, very slow pages, or simply be unable to connect.
But not all DDoS attacks seek to fill the data connection. Some focus on requests that force the server to work hard. For example, a request that executes costly queries can consume more resources than downloading a small file.
How to distinguish an attack from a normal traffic spike?
It's not always easy. A viral news story can also attract thousands of people at the same time.
There are clues that help: sudden increases in requests, repetitive patterns, specific saturated routes, many simultaneous errors, and abnormal resource consumption. However, attributing that behavior to an attacker requires observing context, logs, and network data.
It is not advisable to block countries or addresses indiscriminately as a first reaction. You could prevent legitimate users from entering without stopping the problem.
What are the usual defenses?
Distribute traffic: content delivery networks and specialized services can absorb part of the load before it reaches your server.
Limit requests: rate limiting rules help prevent certain abuses, especially when a client makes too many requests in a short time.
Filter patterns: a WAF can identify and block some malicious requests at the application level.
Prepare the infrastructure: measure capacity, configure alerts, and know the provider's procedure to help you react better.
None of those measures is an absolute guarantee. Protection depends on the type of attack, the website architecture, and the capacity of the services involved.
Does having a larger VPS solve it?
Not necessarily. If the bottleneck is the connection or an application processes very expensive requests, doubling CPU and RAM may not solve anything. There are attacks for which it is more important to filter traffic before it reaches the server.
That is why it is recommended to understand the complete architecture: DNS, CDN, proxy, application, and database.
How does it fit with ArduMaker?
If you host an application on an ArduMaker VPS, it is advisable to protect the published services and study where to apply limits, filtering, and alerts. DDoS security does not depend solely on the VPS: it also matters what is in front of the server and what protection the provider's network offers.
To remember: a DDoS seeks to prevent normal access to a service. The best defense is not to "withstand everything," but to prepare an architecture that recognizes, limits, and absorbs abusive traffic at different layers.
To learn more: What is a DDoS attack.