Most small business websites will never be the main target of a DDoS attack, so there’s no need to lose sleep over it. But attacks are cheap, short and rising in Australia, and a small one is enough to knock over an unprotected site. Sensible DDoS protection means traffic filtering in front of your server, a host who answers quickly and a simple plan for staying in touch with customers if the site goes offline.
Key takeaways
- A DDoS attack floods a website with junk traffic until real visitors can’t get through. It doesn’t usually steal data.
- ASD responded to more than 200 denial-of-service incidents in 2024–25, up more than 280% on the year before.
- Most attacks are small and over within minutes, but still big enough to overwhelm an ordinary server.
- Protection works best before traffic reaches your server, which makes it mainly your host’s job.
- Write down who to call and what to tell customers before you ever need it.
What is a DDoS attack?
A denial-of-service (DoS) attack tries to disrupt a website, email or DNS service by flooding it with data, connections or requests. A distributed denial-of-service (DDoS) attack does the same from many computers or internet-connected devices at once (ASD).
Think of a shop doorway blocked by a crowd that has no intention of buying anything. Nothing is broken into and nothing is stolen, but real customers can’t get in. Many of the devices involved are hijacked household gadgets, such as smart TVs and security systems.
How common are DDoS attacks in Australia?
More common than they were. ASD’s Australian Cyber Security Centre responded to more than 200 incidents involving DoS or DDoS attacks in 2024–25, up more than 280% on the previous year. Denial of service featured in 16% of all the incidents it responded to (ASD Annual Cyber Threat Report 2024–25). Those are mostly larger organisations, and ASD notes that part of the rise came from attacks on the financial sector.
Globally, Cloudflare blocked 18.2 million network-layer DDoS attacks in the third quarter of 2026 alone. Of those, 96% ended in under 10 minutes and 98% stayed under 1 Gbps, which Cloudflare describes as “more than enough to overwhelm a server or website” (Cloudflare). Most attacks are small and brief, and a small one is still big enough.
How worried should a small business be?
ASD says most attacks aim to cause productivity and financial loss, or to draw attention to a cause. So your risk depends on who might hold a grudge and how much an outage would cost you:
| Your website | Likely risk | Why |
|---|---|---|
| Brochure site for a local service | Low | Few reasons to target it. An outage is annoying, not costly. |
| Online shop or booking system | Medium | Downtime during a sale or busy season costs real money. |
| Health, legal or financial practice with client logins | Medium to high | Clients rely on access to bookings, records or accounts. |
| Political, controversial or gaming sites | Higher | Hacktivists and rivals pick targets on purpose. |
Small sites can also be caught in someone else’s attack. On cheap shared hosting, a flood aimed at a neighbour can slow everyone on that server. If you run a clinic, our guide to website hosting for medical practices covers uptime and privacy in more detail.
What does a DDoS attack look like?
To visitors, the site is down or painfully slow, often with “503” or “504” errors. Behind the scenes, your host may see:
- a sudden spike in traffic from many countries at once
- server resources maxed out with no rise in sales or enquiries
- thousands of requests to one page, such as search or login.
Google slows its crawling when a site returns server errors. Pages already in its index are kept, and only dropped if they keep returning errors (Google Search Central). So a short outage is a temporary problem, while a long one can cost rankings.
What DDoS protection is sensible for a small business?
ASD says preparing before an attack is the best strategy, because responding without preparation is harder and less effective.
Filtering in front of your server
The most useful protection is a cloud-based mitigation service or content delivery network that absorbs junk traffic before it reaches your server. This is the hosting layer, so ask about it when you compare secure web hosting. A WordPress firewall at the server or edge also helps against smaller floods aimed at logins and forms.
Don’t rely on a plugin alone
A WordPress security plugin runs inside WordPress, so junk requests use server time before it sees them. It helps with logins and malware, not floods.
Questions to ask your host
ASD suggests asking your providers about these points before you need them:
- Can you mitigate most attacks automatically, without a person stepping in?
- Will I be charged for attack traffic, and can I set a billing limit?
- At what point would you take my site offline to protect other customers?
- Who do I call during an attack, and at what hours?
A plan B for your customers
ASD recommends a lightweight static version of your website. For most small businesses, a simpler plan works: keep your phone number on your Google Business Profile and social pages, and have a short message ready. Monitoring alerts mean you hear about an outage before customers do.
What should you do during an attack?
- Call your host first. Confirm it’s an attack and not a fault, and ask what they can switch on now.
- Turn off heavy features. ASD suggests disabling site search, dynamic content and large files that make the attack more effective.
- Tell your customers. Post on social media and update your Google Business Profile with how to reach you.
- Report it. Report to ASD at cyber.gov.au or call 1300 CYBER1 (1300 292 371). If someone demands payment to stop the attack, report that too before doing anything else.
How we approach DDoS protection
We’d rather be honest than alarming. In our experience, the realistic risks for most small sites are bot floods, login attacks and busy periods, not a targeted DDoS. Our hosting plans run in NEXTDC data centres in Brisbane and Melbourne, with set CPU cores and memory for each plan.
Maintain & Protect adds firewall and login protection, uptime monitoring and ongoing website security monitoring. If you think you’re under attack right now, call our 24/7 emergency line on 0426 833 422.
Frequently asked questions
Can a DDoS attack hack my website or steal data?
Not usually. A DDoS attack aims to make your site unavailable, not to break in. Once things settle, it’s still worth checking your logins and security alerts.
How long does a DDoS attack last?
Most are short. Cloudflare reported that 96% of network-layer attacks in the third quarter of 2026 ended in under 10 minutes. That’s too fast for anyone to react by hand, which is why filtering needs to work automatically.
Is a CDN enough DDoS protection?
For many small sites, a reputable CDN in front of the server is a sensible step. It needs setting up correctly, including firewall rules so only the CDN can reach your server and attackers can’t go around it. Ask your host whether they already provide similar filtering.
Should I report a DDoS attack?
Yes. Report it to ASD’s Australian Cyber Security Centre at cyber.gov.au or on 1300 CYBER1 (1300 292 371). Reports help ASD track attacks against Australian businesses, and they can offer advice.
Sources
- Preparing for and responding to denial-of-service attacks, Australian Signals Directorate, March 2025
- Annual Cyber Threat Report 2024–25, Australian Signals Directorate, October 2025
- DDoS threat report for 2026 Q3, Cloudflare, October 2026
- How HTTP status codes and network errors affect Google Search, Google Search Central