Denial-of-service (DoS and DDoS) attacks explained for small business websites

A DDoS attack (distributed denial-of-service attack) tries to knock a website or online service offline by overwhelming it. This guide explains denial-of-service at a high level for small business websites: what DoS and DDoS mean, why small sites can be affected, what ASD’s ACSC says about preparing and responding, and the general kinds of protection hosting providers offer. It doesn’t describe how attacks are carried out.

What a denial-of-service attack is

ASD’s ACSC describes denial-of-service (DoS) attacks as “cyberattacks designed to disrupt or degrade online services”. The targets it lists include websites, email and DNS (the system that turns a web address into the location of the server).

The goal is to stop legitimate users getting in. ASD explains this is usually done by flooding a service with more data, connections or requests than it can handle. Think of a shop doorway jammed by a crowd that has no intention of buying anything: the real customers can’t get through.

DoS versus DDoS

A distributed denial-of-service (DDoS) attack is, in ASD’s words, “a common type of DoS attack”. Instead of coming from one place, the traffic comes from many computers, internet-of-things (IoT) devices and other connected devices at once, at a much larger scale.

ASD explains that compromised IoT devices, such as smart TVs, kettles, vacuum cleaners and security systems, can form these networks of hijacked devices (called botnets), with households and organisations “unintentionally contributing” to attacks. Keeping home devices updated and secured is part of the bigger picture; see securing smart speakers, cameras and doorbells and home Wi-Fi and router security.

Why it matters for a small business

For most small businesses, a DoS attack is a disruption rather than a data theft: the website, online booking or shop goes down for a while. ASD notes that attacks can cause “an organisation productivity and financial loss”, or be used “to gain public attention for a cause”.

ASD’s ACSC small business guide says “Websites are a prime target for cyber attacks.” ASD’s DoS publication also points out that compromised devices can contribute to attacks “that could impact others”, so a business doesn’t have to be singled out to feel the effects of the wider problem.

A fictional example

Mia runs a small online plant nursery at greenleaf.example. One Friday the site becomes painfully slow, then stops loading. Her hosting control panel shows traffic far above normal, from all over the world.

She emails her host’s general support address and waits. Because she never checked what her plan included, she doesn’t know whether the host will filter the traffic, switch the site off to protect other customers, or charge for the extra bandwidth. That uncertainty is exactly what ASD’s guidance describes sorting out in advance.

How hosting providers protect websites, in general terms

Many small business websites are hosted by a provider rather than run on the business’s own server. ASD’s ACSC small business guide describes using online services “for things like email or website hosting rather than running and securing these services yourself”. In that arrangement, much of the DoS protection sits with the provider, but who is responsible for what depends on the plan and contract. Our guide to the shared responsibility model explains that idea.

ASD’s DoS publication describes several kinds of protection in general terms:

• Content delivery networks (CDNs). A CDN spreads copies of a website across many locations so that traffic is absorbed before it reaches the main (“origin”) server. ASD describes considering a CDN with functionality to protect the origin web server, and notes some CDNs include this as part of a web application firewall.
• Cloud-based DoS mitigation services. ASD describes procuring a cloud-based DoS mitigation service that filters traffic.
• Reputable providers for core services. ASD describes outsourcing foundational services such as DNS to reputable providers.
• Separating services. ASD describes “partitioning critical online services (such as email) from other online services that are more likely to be targeted”, so an attack on one is less likely to take down the other.

How to prepare: what ASD’s ACSC describes

ASD’s guidance is written for any organisation running online services. The points below are drawn from it (checked October 2026); the full publication has more detail.

Decide what has to stay up

ASD describes first working out whether each online service must stay running during an attack, or whether a temporary interruption is acceptable. An online shop and a brochure site may get different answers.

Questions to ask your hosting provider

ASD lists questions to discuss with service providers before there’s a problem, including:

• their “proven capability to withstand DoS attacks”
• whether they can “automatically mitigate most types of DoS attacks without human involvement”
• how pricing works, and whether a billing limit can be set
• when they might switch services off.

ASD also describes pre-approving actions with providers, keeping their contact details current and available around the clock, and having an out-of-band way to reach them if normal channels fail.

Prepare a fallback and protect the domain

ASD’s guidance is to “Prepare a static version of your website that requires minimal processing and bandwidth”. It also describes using registrar locking and keeping domain registration details accurate.

Add DoS to the incident plan

ASD describes keeping an incident response plan that covers DoS scenarios and exercising it at least once a year. See writing a small business incident response plan, and the small business security checklist for the wider basics.

What to do during an attack: ASD’s steps

ASD’s publication lists these response steps:

• Enact the incident response plan.
• Ask service providers to take immediate action. ASD warns that providers may be “unable or unwilling to respond, or charge additional fees” if this wasn’t discussed beforehand.
• Disable non-vital functionality or remove non-vital content.
• Keep communicating with customers and providers, and keep monitoring availability.
• Report the DoS attack to relevant parties, including ASD.

Reports go through ReportCyber at cyber.gov.au. ASD’s small business guide lists the Australian Cyber Security Hotline as 1300 CYBER1 (1300 292 371).

Things to watch for

• Assuming the host has it covered. Protection varies by plan. ASD’s list of questions for providers is a useful starting point.
• Surprise bills. ASD mentions asking about pricing and billing limits, because extra traffic can cost money on some plans.
• Everything in one basket. If email and the website share one service, an attack on the site may affect email too. ASD describes separating them.
• Distractions. A sudden outage can be stressful, and unexpected emails or calls offering to “fix” it or demanding payment deserve caution. ASD describes keeping provider contact details current, so the provider can be reached through details already on file.
• Contributing without knowing. ASD notes that poorly secured devices can be drawn into botnets. Keeping routers and IoT devices updated helps reduce that.

Common questions

What is a DDoS attack?

A DDoS attack tries to knock a website or online service offline by overwhelming it with traffic from many devices at once. ASD’s ACSC describes a distributed denial-of-service attack as “a common type of DoS attack”, in which many computers, internet-of-things devices and other connected devices send traffic at a much larger scale. See what a denial-of-service attack is.

What’s the difference between DoS and DDoS?

A DoS attack aims to disrupt a service, usually by flooding it with more data, connections or requests than it can handle. A DDoS attack does the same using many devices at once, which ASD says makes it much larger in scale. ASD explains that compromised household devices can form the botnets behind these attacks. See DoS versus DDoS.

Can a small business website be hit by a DDoS attack?

Yes. ASD’s ACSC small business guide says “Websites are a prime target for cyber attacks.” For most small businesses, a DoS attack is a disruption rather than a data theft: the website, online booking or shop goes down for a while. How well a site copes depends largely on its hosting arrangement and plan. See why it matters for a small business.

How do I protect my small business website from a DDoS attack?

ASD’s guidance puts most of the work before an attack. It describes deciding which services have to stay up, asking the hosting provider what protection the plan includes, preparing a static fallback version of the website, locking the domain with the registrar, and adding DoS to the incident response plan. See how to prepare.

What do I ask my hosting provider about DDoS protection?

ASD lists questions to discuss before there’s a problem, including the provider’s “proven capability to withstand DoS attacks”, whether it can mitigate most attacks automatically, how pricing works, whether a billing limit can be set and when it might switch services off. ASD also describes pre-approving actions with the provider. See questions to ask your hosting provider.

What do I do if my website is under a DDoS attack?

ASD’s guidance describes enacting the incident response plan, asking service providers to take immediate action, disabling non-vital functionality, keeping customers and providers informed, and reporting the attack to ASD through ReportCyber. ASD warns providers may be “unable or unwilling to respond, or charge additional fees” if this wasn’t discussed beforehand. See what to do during an attack.

Where to get official help

• ASD’s ACSC for ReportCyber and the 24/7 hotline: 1300 CYBER1 (1300 292 371)
• ASD’s denial-of-service publication for the full preparation and response guidance
• Your hosting provider, using contact details from your account or contract
• business.gov.au for general small business cyber security guidance