In this guide · 8 sections
- 01DDoS attack, traffic spike or bots? How to tell
- 02What to do in the first hour of a suspected attack
- 03How Cloudflare's free DDoS protection helps
- 04Settings to tune after the attack: rate limits and bot rules
- 05Shared hosting, WordPress and other weak points
- 06Reporting a DDoS attack in Singapore
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Check your host's or CDN's traffic graphs first: a flood of requests from many IPs to one URL suggests an attack, a spike after a promotion suggests real visitors. Put the site behind a CDN with DDoS protection such as Cloudflare, turn on Under Attack mode only while it lasts, and add rate limits.
DDoS attack, traffic spike or bots? How to tell
Before changing anything, look at what the traffic actually is. Your hosting control panel, CDN dashboard or server logs show requests per minute, top URLs, top IP addresses and countries.
| Signs | Likely cause | What it usually looks like |
|---|---|---|
| Spike right after a newsletter, ad or media mention | Real visitors | Many pages viewed, normal browsers, orders or enquiries rise |
| Steady heavy crawling of every page, often overnight | Search or AI crawler | A few user agents, many sequential URLs, little else |
| Thousands of requests to one URL (login, search, cart) | Bot attack or layer 7 DDoS | Many IPs, odd or identical user agents, no real browsing |
| Repeated login attempts on wp-login or admin pages | Password guessing (brute force) | POST requests to the login URL from many IPs |
| Site down but traffic graphs look normal | Server, plugin or hosting fault | Errors in logs, high CPU from one process |
| Ransom email demanding payment to stop an attack | Extortion DDoS | Threat may or may not be backed by real traffic |
If the graphs look normal, start with our guide to what to check when a website is down. If the site is on shared hosting with no CDN in front, your host's support team can usually see the traffic even when you cannot.
What to do in the first hour of a suspected attack
Confirm it is traffic, not a fault
Check the CDN or host dashboard for a jump in requests and look at the top URLs and IPs. Take screenshots with timestamps; you will need them for reports.
Tell your host or CDN
Open a support ticket saying you suspect a DDoS, with times and screenshots. Hosts often have network-level filtering they can apply quickly.
Put the site behind a CDN if it is not already
Moving DNS to Cloudflare takes effect within minutes to hours. Make sure your origin server's IP is not published elsewhere, or attackers can bypass the CDN.
Turn on Under Attack mode temporarily
In Cloudflare, switch on Under Attack mode from the zone overview's Quick Actions. Visitors see a short browser check before reaching the site.
Block or challenge what you can see
Add a rule that challenges or blocks the attacked URL, the worst countries or networks if you have no customers there, or the obvious bad user agents.
Protect logins and forms
Rate-limit the login, search and contact form URLs, and check admin accounts have two-factor login.
Turn emergency settings off afterwards
When traffic is back to normal, switch off Under Attack mode and review any broad blocks so real customers are not stuck.
How Cloudflare's free DDoS protection helps
A content delivery network (CDN) sits between visitors and your web server. Attack traffic hits the CDN's large global network instead of your small hosting plan. Cloudflare's DDoS protection documentation says it provides unmetered and unlimited DDoS protection at layers 3, 4 and 7 to all customers on all plans, detected and mitigated automatically.
- Layers 3 and 4 are network floods aimed at your connection or server. A CDN absorbs these before they reach your host.
- Layer 7 is the application layer: floods of real-looking web requests to pages like login, search or checkout. These need rules that understand web traffic, such as rate limits and challenges.
Cloudflare's Under Attack mode performs extra checks to stop layer 7 attacks. Cloudflare describes it as one of the last resorts when a site is under attack. The browser check decides within five seconds, needs JavaScript, and can affect third-party analytics, so do not leave it on permanently.
Our Cloudflare setup guide walks through moving a site onto Cloudflare without breaking email, and web application firewalls explained covers what a WAF adds beyond DDoS protection.
Settings to tune after the attack: rate limits and bot rules
Once the site is stable, put permanent protections in place so the next flood is handled without you.
Post-attack hardening
Cloudflare's rate limiting rules are available on the Free plan, with more options on paid plans. A rule sets how many requests per period are allowed and how long to block once the limit is hit. Start generous, for example a few requests per minute per IP on the login page, and check the security events log before tightening.
Cloudflare's Bot Fight Mode is free and challenges suspected bots, but Cloudflare notes it cannot be customised and may challenge API or mobile app traffic. Test checkout, payment gateway webhooks and any app that talks to your site after turning it on.
Reporting a DDoS attack in Singapore
Report attacks even if you have stopped them. Reports help authorities spot campaigns hitting many businesses.
- SingCERT, the Singapore Cyber Emergency Response Team at CSA, responds to cybersecurity incidents for Singapore organisations. Its SingCERT page lists the contact address singcert@csa.gov.sg and links an incident response checklist and playbooks.
- The Singapore Police Force, if there is a ransom demand, extortion or a threat. Keep the original email with full headers.
- Your host and CDN, who may block the source networks and confirm what happened.
- PDPC, only if personal data was accessed or stolen, which a pure DDoS does not involve. Check carefully before concluding that nothing was taken.
Do it yourself or get help?
If you can log in to your DNS and hosting, putting the site behind Cloudflare's free plan and adding a couple of rate limits is a job you can do in an afternoon, ideally before anything goes wrong.
If your site is being hit now, or you want it hardened properly, our Website Security Hardening (S$290) puts a web application firewall in front of the site, updates the CMS, theme and plugins, adds login protection and two-factor login for admins, enforces HTTPS and security headers, and sets up an off-site backup.
Frequently asked questions
Look at your host's or CDN's traffic graphs. A DDoS usually shows a sudden flood of requests from many IP addresses, often to one URL such as login or search, with no matching rise in real orders or enquiries. A spike after a promotion with normal browsing patterns is more likely genuine visitors.
Cloudflare says it provides unmetered and unlimited DDoS protection at network and application layers to all customers on all plans, including Free. For application-layer floods you may still need to add rate limiting rules, challenges or Under Attack mode, and make sure attackers cannot reach your server's IP address directly.
No. Cloudflare describes Under Attack mode as one of the last resorts when a site is under attack. It shows every visitor a browser check, needs JavaScript and can affect analytics tools. Turn it on during an attack and off again once traffic returns to normal, relying on rate limits and rules day to day.
Report it to SingCERT at the Cyber Security Agency using singcert@csa.gov.sg, and to the Singapore Police Force if there is a ransom demand or threat. Also inform your hosting provider and CDN. If personal data may have been accessed during the incident, assess whether a PDPC notification is required.
Yes. Aggressive crawlers and scraping bots can send thousands of requests, especially to uncached search or filter pages on cheap hosting. That is not always an attack, but the effect can be similar. Caching, rate limits and bot rules at your CDN reduce the load without blocking real customers.