What to do when you have DDoS attack?

[Nomad]

Recently, my forum was under DDoS attack. Thankfully I did not have to take any action as my web host handled the issue. However, in less than 12 hours, my website was under DDoS attack for the second time. My web host says that I need to take action on my own as that was the second attack. What do I do now? Where do I begin.

 

[Tracy]

Put your site under CloudFlare... of course, odds are now they know the IP of your server so you may need to see about getting an IP change if possible after going under CF.

 

[Empire]

We all hate when that happens worse for the owners of any site more so than the members. I mean very active members can get pooped off. But end of the day it can happen and even with high tight security in place it still doesn't stop them ;( end of the day you can slow them down as much as you can till they move on.

I use Cloudflare and whatever my hosts has ;P

 

[kensonplays]

Put your site under CloudFlare... of course, odds are now they know the IP of your server so you may need to see about getting an IP change if possible after going under CF.

Yep before I re-released my site as an actual site, I put it under CF. Previously it just redirected to my stream. I haven't gotten hit by a DDoS yet, but if it ever happens, hopefully CF will mitigate it properly.

 

[Ravenfreak]

You should go with Cloudflare to protect your site. Also some hosts offer extra security features you can purchase, but if your host contacted you to deal with it then you'll just have to go with Cloudflare.

 

[Tyrsson]

@Nomad
I’ll try to remember to post up a guide over the weekend.

 

[Nomad]

Thank you guys for your suggestion.
@Tyrsson I am looking forward to your advice on how I can start using Cloudflare

 

[SoluDome]

Recently, my forum was under DDoS attack. Thankfully I did not have to take any action as my web host handled the issue. However, in less than 12 hours, my website was under DDoS attack for the second time. My web host says that I need to take action on my own as that was the second attack. What do I do now? Where do I begin.

Well I have done setups for many sites and hiding the ip of server is something that we require.

Generally from what I have seen your IP gets leaked if

1. You sending mail from same server better use Amazon SES
2. Letsencrypt SSL - Better use a paid SSL

Even cloudflare can't protect you if you basic setup is not right, as one can directly attack on the server IP. So you should go with hosting providers that provides good DDOS protection. I prefer OVH for this one reason. They never complained about DDOS, doesn't matter how many times we have received it.

 

[Nomad]

Well I have done setups for many sites and hiding the ip of server is something that we require.

Generally from what I have seen your IP gets leaked if

1. You sending mail from same server better use Amazon SES
2. Letsencrypt SSL - Better use a paid SSL

Even cloudflare can't protect you if you basic setup is not right, as one can directly attack on the server IP. So you should go with hosting providers that provides good DDOS protection. I prefer OVH for this one reason. They never complained about DDOS, doesn't matter how many times we have received it.

Thank you very much for your advice. I will consider switching to OVH. The site in question has a paid DV certificate and I also avoid sending emails from the same server.

 

[kensonplays]

Thank you very much for your advice. I will consider switching to OVH. The site in question has a paid DV certificate and I also avoid sending emails from the same server.

We're on an OVH Public Cloud (VPS with insane resources) on our site, if you want to see how fast things run for us.

 

[Cory]

My site too was recently under multiple DDoS attacks. There's nothing I could do about it since I'm on Jcink and we do not have server-side access to our boards, but the Jcink owner quickly stepped in to help put the attacks under control. He put a "checking browser" screen on my site to help deter the DDoS attacks. He stated the attacks that were on my board were some of the largest he'd ever seen.

 

[Tracy]

He put a "checking browser" screen on my site to help deter the DDoS attacks. He stated the attacks that were on my board were some of the largest he'd ever seen.

Honestly surprised that they didn't kick you to the curb like most free hosting sites would do..... and got a feeling if that's a repeating occurrence, you may be looking for new hosting.

 

[Cory]

Honestly surprised that they didn't kick you to the curb like most free hosting sites would do..... and got a feeling if that's a repeating occurrence, you may be looking for new hosting.

He actually apologized for the occurrence and knew it wasn't my fault and was out of my control, so he did his best to rectify the issue.

I know the source of the attacks, but I do not know the individual that is behind it all.

 

[Tracy]

He actually apologized for the occurrence and knew it wasn't my fault and was out of my control, so he did his best to rectify the issue.

It's rarely the site admins issue.. the "issue" is the resources it starts impacting and how it impacts other sites on that hosting... happen often enough so that it degrades other sites... you can expect a boot. Been that way on shared hosting and VPS's for as long as I can remember.

 

[Spartan]

Yep before I re-released my site as an actual site, I put it under CF. Previously it just redirected to my stream. I haven't gotten hit by a DDoS yet, but if it ever happens, hopefully CF will mitigate it properly.

Yeah my host make it easy to enable through Chanel, as it helps them in the long run

 

[Alex]

Bizdustry was hit last year resulting in downtime. We’ve had peaks and small attacks this year but no downtime was logged, due to using Litespeed and Cloudflare to mitigate the requests.

 

[Empire]

Cloudflare

free or paid?

 

[Alex]

free or paid?

Paid, business plan.

 

[Empire]

Paid, business plan.

Yeah, I use free, gives me the firewall and basic stuff LOL

 

[Tracy]

Yeah, I use free, gives me the firewall and basic stuff LOL

It gives you quite a bit more than that....
You get unlimited and unmetered DDOS protection.
But you really need to have it running before your site goes public to help prevent leaking of the IP address.
There are certain reasons for going paid (if needing Polish, and related features like that), but their free tier offering is a beast of an offering. I'm honestly surprised that now that they have "made it big" they haven't reduced what they offer on that tier.