Picture this scenario: it’s the middle of the week, your most important ad campaign just launched, and you get an alert: “Store is down.” You try to load the site: it hangs forever or returns a 503 error. Your server logs are bursting at the seams with thousands of requests per second from unknown IP addresses.
This is a classic DDoS attack (Distributed Denial of Service). Instead of panicking, you need to act. Every minute of downtime means real financial and reputational losses.
As infrastructure specialists, we’ve put together proven crisis response procedures. Here is a precise action plan you should follow in the first 30 minutes after detecting an attack.
⏱️ Minute 1-10: Quick Diagnosis and Confirming the Attack
The first mistake is assuming right away that it’s a hacker attack. Before you start rolling out crisis procedures, make sure you know what you’re dealing with.
-
Verify global availability: Use tools such as DownForEveryoneOrJustMe or Uptime Robot. Make sure the problem isn’t only on your own internet provider’s side.
-
Check your server statistics (if you have access): Are you seeing a sudden, unnatural traffic spike? Are the requests coming from unusual geolocations (e.g., Russia, China, Brazil) you don’t normally do business with?
-
Check resource usage: Is CPU and RAM usage sitting at 100%?
Expert tip: Standard shared hosting usually doesn’t give you access to detailed logs. If your business relies on e-commerce, a truly baseline requirement should be high-performance VPS servers, which provide isolated resources and full control over your traffic.
If you confirm the traffic is artificial and is paralyzing the machine, you’re dealing with a DDoS attack. Time to act.
⏱️ Minute 10-20: First Line of Defense and Traffic Mitigation
Once you know an attack is underway, you need to cut off the “bad” traffic before it ultimately kills the database.
-
Enable “Under Attack” mode: If you use Cloudflare or another CDN (Content Delivery Network), immediately activate “I’m Under Attack” mode. This forces everyone trying to reach the site to solve a JS/Captcha challenge, which effectively filters out simple bots (so-called layer-7, application-layer attacks).
-
Block foreign traffic (geoblocking): If you only sell in Poland, temporarily blocking traffic from abroad at the firewall level (or in an .htaccess/.conf file in Nginx) can cut off as much as 80% of traffic from global botnets.
-
Contact your IT support: Time is money. Report the incident to whoever normally handles server administration at your company. A professional admin can deploy firewall rules (e.g., iptables/nftables) within minutes to block packets matching a specific signature.
⏱️ Minute 20-30: Crisis Communication and Contacting Your Hosting Provider
Volumetric attacks (layer 3 and 4), which work by flooding the “pipe” with gigabits of data per second, cannot be stopped from the server level alone. Your hardware simply won’t be able to process that much traffic in time.
- Call the data center: Contact your hosting provider’s operator. Unfortunately, with standard hosting it’s a common (and painful) practice to use so-called null-routing (blackholing). This means the data center… completely cuts your site off from the internet in order to protect other customers on the same server rack.
- Inform your customers: Use social media (Facebook, LinkedIn). Post a short, professional statement: “We’re experiencing temporary technical issues caused by a spike in traffic. Our technicians are working to restore store availability. Your data is safe.” Honesty builds trust.
What to Do Once the Dust Settles? (Prevention for the Future)
DDoS attacks are cheap in 2026: they can be rented on the dark web for a few dozen dollars, often commissioned by unscrupulous competitors. If you survived the first strike, be sure the attackers will be back.
To sleep soundly, you need a proactive approach:
-
Dedicated anti-DDoS protection: Don’t rely on free plugins. Properly securing a business requires BGP routing and a so-called scrubbing center (traffic-cleaning center). Professional DDoS attack protection can neutralize attacks of hundreds of Gbps before they ever reach your server.
-
Infrastructure audit: DDoS is often just a smokescreen for other hacking activity (e.g., attempts to steal your database). After fending off the attack, commission a comprehensive IT security audit to make sure no backdoors were left in the system.
-
Performance optimization: The better optimized a server is, the harder it is to knock down.
Don’t Wait for the Next DDoS Attack
The cost of e-commerce downtime is counted in thousands of PLN per hour. Lacking proper protection means an unacceptable risk of a DDoS attack that no serious company can afford to take.
Seeing suspicious traffic on your site? Or maybe you want to secure your infrastructure BEFORE the worst happens?
Contact us right now. Our administrators will analyze your architecture and deploy protective shields that guarantee your site 99.9% availability, no matter the scale of the attack.