An association blog goes down. No competitor, no bank data. The admin gets an email: "0.5 BTC and it stops." The €6/month VPS saturates on bandwidth; the host cuts the server to protect the network. The small site was a target — because it was easy, not because it was rich.
Distributed denial of service drowns a service in junk traffic. Small sites believe they are invisible. They are less invisible than they think: known IP, standard WordPress stack, no safety margin.
Why a small site gets targeted
| Motive | Mechanism |
|---|---|
| Extortion | Email plus flood until payment |
| Personal conflict | Forum, politics, gaming |
| Collateral | Same IP range as another target |
| Botnet scan | Exploit then test flood |
| Local competition | Rare but documented |
Being small does not immunise you. It sometimes reduces interest — not the probability of an automated scan.
Where fragility hides
An entry VPS often offers 100 Mbit/s or less, with a kernel sensitive to SYN floods. On shared hosting, a neighbour under DDoS slows everyone; shared IP may get blacklisted — see our shared IP investigation. Without CDN, origin is exposed directly. A heavy API route amplifies L7 attacks. Forms without captcha add spam and load.
Proportionate defence on a modest budget
Put a CDN or proxy in front of origin — Cloudflare, or network anti-DDoS from the host (OVH VAC, etc.). Configure rate limiting via nginx, CDN rules or modest fail2ban. Apply aggressive caching on static assets so origin breathes — see CDN first steps. Disable WordPress XML-RPC if unused. Set up monitoring: abnormal traffic, 502 spikes, bandwidth. Prepare an incident plan: who toggles proxy, who contacts the host.
Enterprise protection is not required for most small sites; avoiding origin exposure is.
During an attack: useful order
First confirm DDoS vs legitimate spike (sales, viral content). Enable orange proxy or CDN if available. Switch to challenge or temporary under-attack mode. Alert the host — network mitigation may be possible. Do not reboot in a loop without diagnosis. Document logs; file a complaint if extortion.
The climax: paying guarantees nothing
Small sites mostly underestimate indirect cost: reputation, SEO down, customer support — not just the infra bill.
Decide and move forward without blind spots
Hide origin via CDN from day one, not after the first attack. Read the host anti-DDoS SLA before signing. Configure rate limiting and cache on expensive routes. Prepare incident contacts (host, CDN, technical lead). Compare offers via the directory and our WAF guide.
Frequently asked questions
Why attack a small site?
Extortion, conflict, collateral, opportunist botnet.
Does shared hosting protect against DDoS?
Basic mitigation; neighbour can impact you. Read SLA.
Is free Cloudflare enough?
Often volumetric; sophisticated L7 sometimes needs paid plan.
What to do during an attack?
CDN proxy, rate limit, host contact, document; ransom without legal strategy discouraged.
A small site can be a DDoS target because it is reachable — not because it is important. Reduce exposure before you become the proof.