Your site is under DDoS attack: what to do in the first 10 minutes

The site is down, load average is through the roof, and your connection count is at a number you have never seen before. The first instinct is usually to reboot the server — which is close to the least useful thing you can do while an attack is still running. Here is what actually helps, in order.

First, make sure it is an attack

A campaign, a link from a popular site, or one good social post can flatten a server exactly the same way. Every step you take before making this distinction is a coin flip: mistake a genuine rush of visitors for an attack, start blocking, and you have personally shut down the best day your business ever had.

Look at three things on the server:

• Where are the requests going? Real visitors browse — different pages, images, stylesheets. An attack usually piles onto one path, or onto paths that make no sense at all.
• How scattered are the sources? A legitimate rush comes from hundreds or a few thousand addresses that broadly match your normal audience. An attack shows tens of thousands of addresses, often from countries where you have never had a customer.
• Do they behave like browsers? Are the User-Agent strings suspiciously identical, is the referer empty, do they carry cookies? Real browsers carry cookies. Most attack traffic does not.

Do not: three moves that make it worse

1. Rebooting the server

If the attack is still running, the server walks straight back into it the moment it comes up — and it is at its most fragile during boot. A reboot reliably accomplishes exactly one thing: destroying the connection state and counters you needed in order to diagnose the problem.

2. Taking the server off the proxy to "test something"

When a site is slow, it is tempting to disable protection to check whether the proxy is the bottleneck. Do that during an attack and you hand your real server IP to the attacker. There is no undo: once the address is known, hiding it again means moving the server to a new one.

3. Blocking countries at random

In the middle of an incident it feels decisive to say "it is all coming from country X" and block it. Modern attacks run on compromised home devices spread across dozens of countries. Blocking one stops a sliver of the attack and locks out real customers.

What to do, in order

1. Capture evidence. While it is happening, grab ss -ant | wc -l, the distribution of source addresses, and a sample of your web server access log. You cannot reconstruct these afterwards, and you will need them when you open a ticket with your provider — or with us.
2. Identify the layer. Network interface saturated but the web server idle? That is a network-layer (L3/L4) flood. Network fine but the web server drowning in its request queue? That is an application-layer (L7) attack. They need different answers.
3. Close the origin. Your server should accept connections only from your proxy addresses; everything else gets dropped at the firewall. This single step eliminates every attack aimed directly at your IP.
4. Move traffic onto a filtered path. Point DNS at a proxy that actually scrubs. If your TTL is low you will see the effect in minutes; if it is high, in hours — which is exactly why TTL should be lowered before you need it, not during.
5. Turn on bot filtering. In an L7 attack the requests are real HTTP requests, so you separate them by behaviour rather than volume. A JavaScript browser check — no CAPTCHA needed — removes the overwhelming majority of automated clients.
6. Then measure. When it is over, write down which rule actually worked. Next time, those notes hand you back the ten minutes.

After it stops

The attack ends, everything recovers, and most people stop there. That is a mistake, because the same attacker usually comes back. The permanent list is short: keep DNS TTLs low, firewall the origin down to your proxy addresses only, and audit whether your real server IP is leaking through old DNS history.

That last one gets missed far more often than people expect — the details are in how your origin IP leaks.

Protect your site with OZELNS

Authoritative DNS and reverse-proxy DDoS protection in one panel. Free plan available, no card required.