What is DDoS protection, and does a small site really need to pay for it?

What a DDoS attack actually is

A distributed denial-of-service attack is an attempt to make your website unavailable by overwhelming it with traffic from many machines at once — often a botnet of thousands of compromised devices — so that real visitors can’t get through (Fastly, 2026). Attacks come at different layers: volumetric and protocol floods at layers 3 and 4 aim to saturate your bandwidth or connection capacity, while application-layer (layer 7) attacks target specific pages or functions like a login form to exhaust the server doing real work (Cloudflare, 2026). In 2026, large attacks frequently exceed three to four terabits per second, and the record sits around 71 million requests per second.

The reason it matters to a business of any size is the cost of being offline. A DDoS attack that takes your site down loses you sales and reflects poorly on your brand, since customers expect a reliable experience and read downtime as a warning sign (Fastly, 2026). And small sites are not exempt — they’re hit through extortion, botnet activity, competitor mischief, or simply as collateral in a broader attack. The good news, which the enterprise marketing tends to bury, is that protecting a small site is cheap. This is the availability side of the total picture our pillar on what a website really costs sets out.

How protection works

The core idea is filtering before your server ever sees the traffic. Protection services route your incoming requests through a large network — a CDN’s edge or dedicated scrubbing centres — that analyses traffic in real time and blocks malicious requests while letting legitimate ones through, using rate limiting, anomaly detection, traffic challenges, and IP-reputation and geo filtering (Gartner, 2026). Because these networks are enormous — the largest run hundreds of terabits per second of capacity across data centres worldwide — they can absorb a volumetric flood that would instantly bury a single server (Cloudflare, 2026).

There are two deployment styles worth knowing. Always-on protection routes all your traffic through the mitigation network continuously, so it responds the instant an attack begins; on-demand protection only activates once an attack is detected, which leaves a window in which damage can happen — so for anything business-critical, always-on is the safer default (Indusface, 2026). In practice, for a typical website this filtering comes bundled into a CDN, which is why the same CDN that speeds up your site is usually also what protects it.

What it actually costs, and the fear premium

Here’s where the honest numbers diverge sharply from the sales pitch. A reputable CDN’s free tier includes unmetered mitigation of layer 3/4 volumetric attacks for any site proxied through its network — genuinely free and genuinely effective for the bulk of what small sites face — with a Pro tier around $20 a month adding a web application firewall (SecureBin, 2026). At the other end, enterprise scrubbing services run from a few thousand dollars a month into the tens of thousands, aimed at banks, governments and large-scale e-commerce with mission-critical uptime needs (Flowtriq, 2026). Cloud platforms sit in between: AWS Shield Standard is included free with every AWS account but runs silently with no visibility, alerts or forensics, while its Advanced tier costs around $3,000 a month, and comparable managed WAF-and-DDoS bundles for small businesses start near $59 to $250 a month (Flowtriq, 2026).

Tier	Typical cost	Who it’s for
CDN free tier	Free, unmetered (L3/L4)	Most small and mid-size sites
CDN paid (WAF, L7)	~$20–200/month	Growing sites, logins/payments
Enterprise scrubbing	$3,000–$20,000+/month	Banks, governments, large e-commerce

Two cost traps deserve a warning. The first is surge billing: some vendors charge per request during an attack, so a sustained flood turns your defence into a surprise bill — which is why flat, unmetered pricing that doesn’t charge for attack traffic is worth insisting on (Indusface, 2026). The second is the add-on trap on the hosting side, where basic DDoS mitigation that should be included gets sold back to you as a paid extra — the same unbundling pattern our guide on hosting cost flags across SSL, backups and email.

The static-site advantage

There’s an architectural reason a well-built site is easier to protect, and it’s the same reason it’s cheaper to host. Modern CDNs bundle DDoS mitigation, a web application firewall and TLS encryption, blocking malicious traffic at the edge before it reaches your origin (Naturaily, 2026). For a static site, that edge does even more work: the site is served as pre-built files cached across hundreds of edge locations, so there’s no single origin server running database queries and application code on every request — which is precisely what an attack tries to exhaust. A flood mostly lands on cached copies at the edge rather than on your server, so the site stays up.

A database-driven site with one busy origin is far easier to knock over, because every request can force real computation. The practical upshot is that static architecture gives you resilience as a property of how the site is built, not only as a product you buy on top. One operational caveat carries real weight regardless of architecture: keep your origin server’s IP address hidden, because an attacker who discovers it — through historical DNS records, email headers or leaked configs — can bypass your CDN protection and hit the origin directly (SecureBin, 2026).

Why we include it — and when you don’t need more

Stated plainly as the commercial party we are: DDoS protection is part of the hosting we run for the sites we build, not a line item we sell back to you. Because we build static sites served through a CDN, edge-level filtering and the resilience of cached-everywhere delivery come with the setup — so a client gets protection against the common attacks as a property of how their site is hosted, alongside the reliable hosting and backups that sit on the same foundation. It’s the opposite of the add-on model, where the essentials are unbundled to lower a headline price.

And the honest gate matters here as much as anywhere: a small business with a static site behind a CDN does not need a $3,000-a-month enterprise scrubbing plan, and we’ll tell you so rather than sell you fear. You’d only reach for enterprise-grade, dedicated protection if you were running genuinely high-stakes infrastructure — large-scale payments, a frequent target, strict uptime SLAs. Short of that, the free-or-cheap CDN tier plus a hidden origin is the right-sized answer, and paying more buys peace of mind you can get for far less.

Resilience is built, not only bought

DDoS protection turns out to follow the pattern that runs through everything here: the fear-based version sells you an expensive product, and the honest version points at how the thing is built. A site served as cached static files behind a CDN is resilient because of its architecture, protected by mitigation that’s largely free, and left vulnerable mainly by mundane mistakes like an exposed origin — not because you skipped a five-figure contract. The money the enterprise pitch wants is, for most small businesses, a premium on anxiety.

So the right-sized approach is simple: put a CDN in front of your site, keep the origin hidden, insist that basic protection be included rather than an add-on, and lean on the resilience that a static build gives you for free. Do that, and staying online through an attack becomes a property of a well-built, well-hosted site rather than a monthly fee — which is the same “do it right once” logic behind our hosting and backup guides, and behind the whole approach our pillar on what a website costs lays out.