This is part 3 of our 8-week series, 8 Types of Cyber Attacks: one plain-English breakdown every Monday of how small businesses actually get hit, and what stops it.
Your website is fine one minute and timing out the next. Online orders stop. Customers call to say the booking page won’t load. Nothing was hacked and no files are missing. Someone is simply flooding your site, or your office internet connection, with so much junk traffic that real visitors can’t get through.
That’s a denial-of-service attack. And it’s far more common than most business owners think. In the first three months of 2025 alone, Cloudflare reported blocking 20.5 million DDoS attacks, a 358% jump over the same period a year earlier.
DoS vs. DDoS in plain English
- DoS (denial of service) is one source overwhelming a target. Think of one person calling your front desk nonstop so nobody else can get through.
- DDoS (distributed denial of service) is the same idea from thousands or millions of sources at once. The “callers” are usually a botnet: hijacked security cameras, home routers, smart devices and infected PCs that the owners don’t even know are participating.
Because the traffic comes from everywhere, you can’t just block one bad address. And DDoS-for-hire services rent out attacks for a few dollars, so the attacker doesn’t need any real skill.
“A DDoS attack doesn’t steal anything. It just makes sure your customers can’t reach you, and that’s expensive enough.”
— Glenn Kupsch, President, Adaptive IT
Why would anyone target a small business?
- Extortion. “Pay us or your site stays down.” Some crews send the ransom note first and attack only if you ignore it.
- Competition or grudges. A rival, an angry ex-customer or a former employee can rent an attack cheaply.
- Distraction. While your team is focused on the outage, the attacker is trying something quieter, like logging in with stolen passwords. Don’t let the flood be the only thing you watch.
- Collateral damage. Your site may share hosting with someone else who is the real target, and you go down with them.
What it actually costs
There’s no data breach, but the bill is real: lost online sales and bookings, phones and payment terminals that ride the same internet connection, staff who can’t reach cloud apps, and customers who quietly try a competitor instead. For a restaurant, retailer or service business that takes orders online, a few hours down on a busy day adds up fast.
What actually stops it
- Put your website behind a DDoS-protection network. Services like Cloudflare absorb attack traffic across a global network before it ever reaches your server. This is the single biggest step, and it’s how we run getadaptiveit.com and our clients’ sites.
- Don’t expose your office directly. Remote access, cameras and servers shouldn’t be sitting open on your office IP address. Fewer open doors means less to aim at.
- A real business firewall with intrusion prevention and rate limiting, kept patched.
- A second internet line with automatic failover so phones, payments and cloud apps keep running if one connection gets flooded or simply fails. We set this up for Tommy Gun’s Pizzeria with Starlink and Spectrum.
- Monitoring that alerts you first. You should hear that your site is down from your IT team, not from a customer.
- Know who to call. Keep your ISP’s and hosting provider’s support numbers in your incident plan, and know who’s allowed to make changes.
- Don’t become part of the botnet. Change default passwords on cameras, routers and smart devices, and keep their firmware updated. Those are the devices attackers hijack.
Not sure where you stand?
Adaptive IT offers a Cyber Review for small businesses: a straightforward look at your website protection, firewall, internet redundancy, MFA coverage, backups and the gaps an attacker would use first. You get a plain-English list of what to fix, in order.
Call the Adaptive IT service desk at (877) 958-1248 or get in touch here.
Next Monday in the series: Man-in-the-Middle attacks. How attackers quietly sit between you and the sites you trust, and why public Wi-Fi is only part of the story.