What is a DDoS attack, and how do you protect your webshop against one?

Cybercriminals are launching DDoS attacks more often, and on a bigger scale than before. For the websites targeted, the damage can be serious. It is not just reputational. The financial cost can be huge too.

So what is a DDoS attack, exactly? How do you recognise one? What causes it, and what can you do to protect your webshop? This article answers all of that.

What is a DDoS attack?

DDoS stands for Distributed Denial of Service. The name says it all: the goal is to deny a service by knocking a server or network offline.

A DDoS attack happens when one or more cybercriminals send a huge amount of traffic to a website or server at the same time. They usually do this using a botnet, a network of hijacked computers and devices that criminals control remotely, often without the owners knowing.

The goal is simple. Flood the server with so many requests that it cannot keep up. Once that happens, real visitors can no longer get through.

Every server has a limit to how many requests it can handle at once. Bandwidth, processing power and memory are all finite. During an attack, fake requests use up that capacity, so there is nothing left for genuine visitors.

How do you recognise a DDoS attack?

As a visitor, you might notice a website you normally trust suddenly stop working, with no obvious reason.

For webshop owners and hosting specialists, DDoS attacks are hard to predict. But once one is underway, there are clear patterns to look for.

Gert-Jan de Boer, Senior Network Specialist, described it like this: “You can recognise a DDoS by the pattern in the network traffic. A lot of attacks share the same characteristics, so once you know what to look for, they’re not hard to spot.”

Why do DDoS attacks happen?

No single reason drives a DDoS attack. Most fall into one of three categories.

Disagreement. Sometimes an attack is political. Cybercriminals who disagree with a company’s stance, or a government’s policy, use a DDoS attack to make their point.

Extortion. This is the most common motive: money. Criminals aim large botnets at e-commerce websites to force them offline.

Say a webshop earns 10,000 euros a day. Five days of downtime could cost the owner 50,000 euros in lost sales. After the attack starts, the criminals often offer a way out. Pay up, and the attack stops. It is a grim calculation, but for some owners, paying is still cheaper than losing days of revenue.

Trolling, or just for fun. Some attackers do it purely for the thrill, and for bragging rights among other hackers. This group is often young people chasing status in hacking circles.

Gamers fall into this category too. A targeted DDoS attack on a competitor’s IP address can cause serious lag or knock them out of a match entirely.

DDoS attacks in the Netherlands

DDoS attacks regularly make the news, especially when they hit governments or banks. That kind of coverage tends to inspire more attacks from people chasing attention.

In 2018, DigiD, the Belastingdienst (the Dutch Tax Authority) and the UWV (the Dutch employee insurance agency) were all hit by a wave of DDoS attacks. Ordinary citizens could not file tax returns or manage their benefits, and security experts publicly called for a national, cooperative approach to fighting DDoS attacks.

Dutch banks have not been spared either. In 2018, ING, Rabobank and ABN Amro all suffered DDoS attacks. Online banking and iDeal, the Dutch online payment method, went down for hours at a time. With several banks affected at once, payment traffic across the country was disrupted.

How do you prevent a DDoS attack?

You cannot fully prevent a DDoS attack if a hacker sets their sights on you. But there is plenty you can do to reduce the risk. Here are seven measures worth taking.

Use a WAF. A Web Application Firewall, or WAF, protects your website by filtering the traffic between your web application and the internet, blocking malicious requests before they cause harm. Cloudflare is one way to turn this on for your site.

Turn on CAPTCHA. CAPTCHA stops bots from taking automated action on your website, such as filling in forms or posting comments. Google’s reCAPTCHA is a common way to add this.

Whitelist IP addresses for your backend. Whitelisting means only allowing traffic from IP addresses you approve. Anything not on that list gets blocked automatically, which protects your backend from attacks aimed at it directly.

Take care of MySQL. MySQL is the database software many webshops run on. Keep it updated and patched regularly. It is also worth closing the default MySQL port (3306) to outside traffic, since your webshop and database usually sit on the same server anyway. If you do need an external program to connect to your database, do it through an SSH tunnel, a secure, encrypted connection between two machines. And always use strong passwords for anyone with MySQL access.

Watch for the signals. An extremely slow or unstable website, well beyond what is normal, is often the first sign of a DDoS attack. Catching it early gives you more time to respond.

Keep your software up to date. Outdated software often has security gaps that cybercriminals can exploit. Regular updates close those gaps.

Invest in good hosting. A reliable host invests heavily in server security, keeps its software current, and runs modern hardware. Talk to your hosting provider about the bandwidth you need, and the risks specific to your business.

What does Hypernode do about DDoS attacks?

As a web host, we know protecting your webshop from DDoS attacks is one of the most important things we do.

When a Hypernode comes under attack, we can route traffic through NaWas, the Dutch national anti-DDoS scrubbing service, via our sister company Combell. NaWas filters out malicious traffic before it reaches your server.

If that is not enough, we can help you set up additional protection, such as Cloudflare. And if a Hypernode ever turns out to be the source of an attack, rather than the target, we disable that site to protect the rest of the network.

What does Hypernode do against DDoS attacks?

We are aware that we, as a web hoster, have an important role in preventing DDoS attacks. Good security of your webshop at the server level is, for us, the most important service we deliver.

Because DDoS attacks are happening more and more, we have invested heavily in our software and hardware.

State-of-the-art infrastructure

At Hypernode, we only go for the best; our infrastructure is a big part of this. Our hardware complies with the highest quality requirements and is connected to a fast, stable and secure network.

We have a bad bot blocker. This measure ensures all requests from ‘bad bots’ will be blocked immediately. The blocker filters the bad bots out and only lets the ‘good’ reliable traffic through.

Another standard measure that is not always common with other web hosts is closing ‘critical locations’ at, for example, Magento 1 shops by default. In addition, we provide advice and help to shield the backend of your website.

So the botnets don’t have access to critical folders where they shouldn’t be anyway.

Stay alert

Alongside the measures your host takes, staying alert matters too. Learn to recognise the early signs of a DDoS attack, and take the risk seriously. Nobody is too small to be a target.

If you have questions about DDoS attacks, or want advice specific to your webshop, get in touch with our security specialists.

DDoS attacks.