Digitalization
10. November 2025 7 min
DDoS attack: what is it, and how do you know if your website is protected enough? Work out your downtime cost and ask your host the right questions
A DDoS attack makes a website slow or unavailable by overloading it with traffic from a botnet. No data is stolen, but the downtime costs you. See how the attack works, get a rough estimate of what downtime costs you, and get the questions to ask your hosting provider.
Indhold
Why should you worry about DDoS when no data is stolen? How does a DDoS attack take a website down? How do you find out if your protection is big enough? What else do people ask about DDoS attacks?DDoS attack
A DDoS attack is an attempt to make a website, a server or a network service slow or completely unavailable by overloading it with traffic from many infected devices at once.
Also called: Distributed denial of service
The target is availability, not data. The attacker does not break in. The attacker makes sure your real visitors cannot get in.
Why should you worry about DDoS when no data is stolen?
A DDoS attack hurts you through downtime: while it lasts, customers cannot buy, log in or find your information. No data is lost, but lost sales, wasted ad spend and annoyed customers are real costs.
Take a Danish online shop that is hit on Black Friday. The site does not respond, and customers cannot pay. No customer data has leaked, and there is nothing to report to the Danish Data Protection Agency. Even so, the most important sales hours of the day are gone.
DDoS is often confused with other incidents. The difference decides what you need to protect yourself against:
| Incident | What happens | Is data at risk? |
|---|---|---|
| DDoS attack | Many devices in a botnet send traffic at the same time, so the site slows down or goes down. | No. It is about availability. |
| Intrusion and data breach | Someone gains access to systems or data they are not allowed to see. | Yes. That is the whole point. |
| DoS | Same idea as DDoS, but the traffic comes from a single source. It is easier to block. | No. |
| Traffic spike from a campaign | Real customers arrive all at once, for example after a newsletter or a TV mention. | No. It is a capacity problem, not an attack. |
Typical targets are ecommerce and other revenue-generating websites, gaming, telecoms, public institutions and forums. The motive can be extortion, activism, competition or simply someone wanting to see if it can be done.
It matters less if your website does not make money directly and has no users who depend on it. An information site can often live with a few hours of downtime. In that case, your hosting provider’s standard protection is usually enough.
How does a DDoS attack take a website down?
A DDoS attack takes a website down by using up all its capacity: a botnet sends so many simultaneous requests that the bandwidth, connections or server resources run out, and real users are turned away. The attack hits either the network layer or the application layer.
A botnet is a network of computers, routers, cameras and other devices infected with malicious software. The owners usually do not know. The attacker controls them as a group and can make them send traffic at the same target at the same time.
What is the difference between network layer and application layer attacks?
Attacks on the network layer are about volume. A SYN flood, for example, opens lots of connections that are never completed, so the server has no room for new ones. The traffic looks abnormal and can usually be filtered before it reaches your server, if your hosting provider has DDoS protection on the network.
Attacks on the application layer look like real visits. In the Black Friday example, the botnet requests product pages, searches and the basket, exactly as customers do. Each request makes the server work, so even a moderate amount can take an online shop down.
That is why the application layer is the hardest to protect. The filter has to tell a bot from a customer in a hurry without blocking the customer. That takes rules set up for your specific website.
How do you find out if your protection is big enough?
You find out if your DDoS protection is big enough by first making a rough estimate of what downtime costs you, then asking your hosting provider what is actually set up on the network layer and the application layer. The more an hour offline costs, the more the answers need to cover.
Start with the cost of downtime. Take your revenue per hour on a busy day, multiply by the hours you expect to be down, and judge how much of the sales will not come back later. Some customers wait and buy tomorrow. Others buy somewhere else.
The result is an estimate, not a measurement of an actual loss. It tells you whether you are talking about a few hundred kroner or a significant share of the month’s sales.
What does downtime cost you if your site is taken down?
Enter your revenue per hour, how long the site is down, and how many customers will not come back. You get a rough estimate of the loss.
Take your revenue on a busy day and divide by the number of open hours, for example 24 for an online shop.
An attack can last from minutes to days. Try both a short and a long duration.
Customers who buy elsewhere or give up. If you are unsure, try 30%.
Rough estimate of lost revenue
6,000 kr.
that does not come back. An estimate, not a measurement
- Revenue not earned while the site was down20,000 kr.
- Of which revenue that comes back later14,000 kr.
Then ask your hosting provider these questions. Get the answers in writing:
- Is there DDoS protection on the network layer? Is traffic filtered before it reaches your server, and is that included in your agreement or an add-on?
- Is the application layer filtered? Is there a web application firewall in front of the site, and can the rules be adapted to your website?
- Is there rate limiting? Is there a limit on how many requests one source can send to heavy pages such as search, login and basket?
- Who responds, and when? Is the site monitored outside business hours, and who switches on extra protection?
- How will you be told? Will you be contacted while an attack is under way, and who on your side should they call?
- What happens to your site during an attack? Will it be disconnected to protect other customers on the same server?
If the estimate is low and the provider answers yes to the first two questions, you usually do not need to do more. If the estimate is high or the answers are unclear, it is time to look more closely at protecting the application layer.
What else do people ask about DDoS attacks?
The most common questions about DDoS attacks are whether small websites are targets, how an attack differs from a successful campaign, what to do during an attack, and whether it has to be reported.
Are small Danish websites hit by DDoS attacks?
How can you tell a DDoS attack from a campaign that works?
How long does a DDoS attack last?
What do you do while a DDoS attack is under way?
Are DDoS attacks illegal, and should they be reported?
Can any solution fully protect against DDoS attacks?
What to remember about DDoS attacks
A DDoS attack does not steal data. It makes your website slow or unavailable, and the damage is the downtime it causes.
Application layer attacks are the hardest to stop, because the traffic looks like real customers and needs filtering set up for your website.
How much DDoS protection you need depends on what an hour of downtime costs you. A rough estimate is enough to decide whether you are talking about small change or a real risk.
The concrete next step is to ask your hosting provider in writing whether the network layer and the application layer are protected, and who responds when an attack is under way.
Review of your DDoS protection
See if your protection matches what downtime costs you
Enter your domain and your email. We will look at how your website and your hosting handle overload, and send you what we find.
- Whether your hosting filters attacks on both the network layer and the application layer
- Which pages on your website are easiest to overload
- Which questions your hosting provider still has not answered
You will hear from us within five working days. No strings attached, and what you do with it is up to you.
Would you rather talk it over a cup of coffee?
