Updated · Senior-Friendly Plain Language
TL;DR
- A DDoS attack floods a website or service with traffic so real users can’t get in. It’s illegal in Canada.
- If your site/service is slow or down, act fast: contact your host/ISP, enable DDoS protections, and communicate with users.
- Prevent repeat attacks with a CDN/DDoS plan, monitoring/alerts, rate-limiting, timely updates, and a basic response playbook.
🌊 What Is a DDoS Attack?
A Distributed Denial-of-Service (DDoS) attack overwhelms a site or service with traffic so legitimate users can’t get through. Attackers often abuse “booters” or “stressers” that generate massive request floods.
Think of it like a traffic jam at a bridge: so many cars pile up that nobody crosses. The result is slow pages, errors, or complete outages.
🧭 Why It Affects You
- Small businesses & community sites: downtime means lost trust and missed appointments/orders.
- Individuals: if a service you rely on is hit, you feel the impact—banking, email, streaming, bookings.
- Collateral risk: infected devices can be hijacked into botnets that power DDoS campaigns; good hygiene protects everyone.
⚡ First Steps If You Think You’re Under Attack
| Step | What to Do |
|---|---|
| Check | Confirm the problem isn’t your own connection—do other sites load? Look for host/monitoring alerts. |
| Contact | Reach your hosting provider/ISP immediately. Ask about rate-limits, filtering, scrubbing, or temporary blocks. |
| Enable protection | Turn on CDN/DDoS features, WAF rules, and “under-attack” modes. Throttle expensive endpoints. |
| Reduce load | Temporarily disable large downloads, search, or heavy plug-ins; serve cached pages only if possible. |
| Communicate | Post a brief status update for users; set expectations and give alternatives (phone/email) while you mitigate. |
If you run a critical service, consider a managed security provider who can monitor and mitigate 24/7.
🛡️ Prevention Tips Everyone Should Know
- Choose hosting with DDoS protection and a CDN that can absorb/spread traffic.
- Set up monitoring & alerts (traffic spikes, error rates) so you see trouble early.
- Use a Web Application Firewall and rate-limit costly endpoints (search, login, API).
- Patch and harden servers, CMSs, and plug-ins—don’t leave known holes open.
- Redundancy & backups: keep snapshots and a standby plan (static fallback, alternate region).
- Incident playbook: contacts, steps, and messages ready to go (no improvising under pressure).
⚖️ What the Law Says
DDoS is a crime in Canada. Launching or paying for DDoS “booter/stresser” attacks can lead to device seizure, restricted Internet access, criminal charges, fines, and prison. Even if a service advertises as a “tester,” using it against systems you don’t own is illegal.
🔗 Suggested Links (Internal & External)
On ScamShield Digest
📚 Sources
Share this: Help a friend or small business owner by sharing this guide.
