What Is DDoS Protection?
DDoS protection detects a distributed denial-of-service flood — junk traffic from many hijacked machines — and filters it at the network edge before it exhausts bandwidth, memory or CPU, so real visitors still reach the site. It covers volumetric, protocol and application-layer attacks. It does not clean malware or replace backups.
For Indian site owners who want to understand DDoS attacks, recognise one, and know what filtering their host provides.
knowledge
- Read time
- 2 min
- Sections
- 5
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
What is DDoS protection?
DDoS protection is the set of network and application filters that detects a distributed denial-of-service flood — junk traffic sent from many machines at once — and drops it before it exhausts your bandwidth, server memory or CPU, so real visitors can still open the site. The attacking machines are usually a botnet of hijacked computers, routers and cameras.
Protection does three things in order: detect traffic that does not match the site's normal pattern, divert it through a filtering edge or scrubbing centre, and pass clean requests on to the origin. It does not remove malware from a hacked site and it does not replace backups; those are separate jobs covered in what is malware scanning.
What are the main types of DDoS attack?
DDoS attacks fall into three shapes — volumetric floods that fill the network pipe, protocol attacks that exhaust connection tables, and application-layer floods that overload the page-building software. Each is measured differently and stopped at a different layer.
| Type | Layer | What fills up | Measured in | Typical mitigation |
|---|---|---|---|---|
| Volumetric (UDP floods, DNS/NTP amplification) | 3–4 | The network port and upstream links | Gbps | Anycast network, upstream scrubbing |
| Protocol (SYN floods, fragmented packets) | 3–4 | Firewall and server connection tables | Packets per second | SYN cookies, stateful filtering at the edge |
| Application (HTTP floods, login or search abuse) | 7 | PHP workers, database and CPU | Requests per second | WAF rules, rate limits, browser challenges, caching |
Amplification attacks abuse open DNS or NTP servers that answer a small spoofed query with a much larger reply aimed at the victim, which is why volumetric floods can be far bigger than the attacker's own bandwidth.
How does DDoS filtering work?
Filtering works by absorbing traffic on a network large enough to swallow the flood, separating bad requests from good ones, and keeping the origin server's real IP address hidden.
- Anycast edge: the same IP is announced from many locations, so attack traffic is spread across the network instead of landing on one server.
- Scrubbing: suspect traffic is routed through filters that drop malformed packets and known attack signatures.
- Rate limiting: caps requests per IP to expensive URLs such as login, search or cart.
- Challenges: a JavaScript or CAPTCHA check that browsers pass and simple bots fail.
- Web application firewall: rules that block patterns in layer-7 requests; see what is a WAF.
- Origin hiding: if attackers learn the origin IP, they can bypass the edge, so firewall the origin to accept web traffic only from the filter.
A proxying CDN provides much of this at its edge; how that layer works is in what is a CDN.
How can you tell a DDoS flood from a genuine traffic spike?
A genuine spike comes from real customers who browse, add to cart and complete forms, while a flood repeats the same requests from networks and countries you do not sell to and ignores cookies and forms.
- Real crowd: varied pages, referrals from your campaign or WhatsApp broadcast, rising orders.
- Flood: thousands of hits on one URL, identical user agents, no conversions, traffic from unrelated regions.
If the logs show real buyers, the answer is capacity, not filtering; see preventing a crash from traffic.
What should you do during a DDoS attack?
Confirm it is an attack, contact your host with evidence, turn on stricter filtering at the edge, and record the incident for reporting.
- Check the access log or analytics for the pattern: repeated URLs, source networks and request rate.
- Email your host the time window, affected domain and log samples; at WebJi® that is support@webji.services, answered 24/7 in Hindi and English.
- Enable "under attack" or challenge mode on your CDN, and add rate limits for the targeted URLs.
- Make sure the origin only accepts web traffic from the CDN's IP ranges.
- Keep timestamps and logs. CERT-In's directions of April 2022 require organisations in India to report specified cyber incidents, including DoS and DDoS attacks, within six hours of noticing them; see CERT-In rules for hosting.
What DDoS protection does WebJi® include?
WebJi® includes network-edge filtering on its hosting plans and volumetric mitigation on dedicated servers; larger scrubbing jobs are quoted in INR by email before you pay, with 18% GST added. No standalone monthly scrubbing price is published.
The only published security fee alongside it is Website Security Consultancy at ₹4,200 a year in WebJi® billing (read 30 October 2026), which is an audit and malware clean-up, not flood capacity. Details are on the DDoS protection service page.
Frequently asked questions
Can a small business website be hit by a DDoS attack?
Yes. Attacks are cheap to rent and are aimed at competitors, gaming servers, political sites and extortion targets. Small sites on shared hosting are also affected when a neighbour on the same network is attacked, which is one reason hosts filter at the network edge.
Does a firewall plugin stop DDoS attacks?
Not volumetric ones. A WordPress firewall plugin runs on the same server it protects, so the flood has already arrived by the time it acts. Plugins help against login abuse; floods must be stopped upstream at the network or CDN edge.
How long does a DDoS attack last?
Anything from a few minutes to several days, often in repeated waves. Short bursts are common because attackers test defences, so keep filtering enabled after the first wave rather than switching it off immediately.
Is DDoS protection the same as a backup?
No. DDoS protection keeps a site reachable; it does not keep copies of data. A flood is sometimes used as cover for an intrusion, so keep tested backups and malware scanning as separate defences.
Last editorial update: 14 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.