A distributed denial-of-service attack, or DDoS, tries to overwhelm a website, VPN, remote access service, or other internet-facing system with more traffic than it can handle. The attacker is not necessarily trying to steal data; the goal is to make the service unavailable.
For a small business, even a short outage can be disruptive. A clinic portal, appointment booking page, ecommerce form, client file exchange, or remote access VPN may be part of daily work. The right preparation is usually a mix of provider-level protection, DNS/CDN decisions, firewall rules, and a clear escalation plan.
DDoS is about availability. Attack traffic may come from many compromised systems or rented infrastructure, making it hard to block by one IP address. Some attacks flood bandwidth; others target web application resources, DNS, or VPN login pages.
Small businesses usually do not mitigate DDoS alone on an office firewall. Effective mitigation often happens upstream at the DNS provider, CDN, hosting provider, cloud platform, or ISP before traffic reaches the business connection.
A professional services firm may experience missed lead forms, unavailable client portals, slow remote access, or interrupted VoIP if the internet connection is saturated. Staff may describe it as the website being down or the VPN being unusable, even though internal computers are otherwise fine.
The operational impact depends on what faces the internet. A static marketing site going down is annoying; a remote access gateway used by a hybrid office on payroll day is more serious. Planning should reflect business dependency, not generic fear.
We can review accounts, endpoints, remote access, and backup readiness against this guide.
FAQ
Rarely as a deliberate target, and that is the point people miss. Small offices are far more likely to be hit as collateral — sharing a host with the intended target, sitting behind an ISP link that gets saturated, or being knocked over by a misconfigured service rather than an attacker at all. The impact on your booking system is identical either way.
Check whether anything else on the same connection still works, and whether the site is reachable from outside your office network. Ordinary outages usually fail cleanly for everyone; volumetric traffic tends to show as slow-then-timeout under load, with the host or CDN dashboard showing the traffic. Guessing wastes the first hour, which is why the escalation path should be written down beforehand.
A CDN absorbs a lot, and for most small business sites it is the single most effective control. It does not cover what sits outside it — your office internet link, a VPN concentrator, or a self-hosted portal on a static IP. Know which of your services are behind the CDN and which are directly exposed.
Three things, none of them expensive: who to call at the host, DNS provider, and ISP; where DNS is managed and who can change it under pressure; and a way to tell staff and clients what is happening while the site is unreachable. Most of the damage in a small business outage comes from the improvised scramble, not the traffic.