Skip to content
Will your site survive Black Friday? Free peak-readiness audit →
SECURITY

DDoS protection for small business websites

What DDoS attacks are, why small businesses are targeted, and affordable ways to protect your website with a CDN, WAF and rate limiting.

By VISIBI Security team·Reviewed by Saeed Ak, Co-founder & CTO·Updated 29 September 2026·6 min read
QUICK ANSWER

What DDoS attacks are, why small businesses are targeted, and affordable ways to protect your website with a CDN, WAF and rate limiting.

KEY TAKEAWAYS
✓DDoS attacks overwhelm your site with traffic until it becomes unavailable.
✓Cloud CDNs and WAFs absorb most attacks affordably.
✓Hiding your origin server IP is essential.

Types of attack

  • Network floods (layer 3/4)
  • HTTP floods on pages or search (layer 7)
  • Login and checkout abuse
  • Bot traffic spikes
RELATED GUIDEHow to stop spam and bot attacks on Adobe Commerce Cloud → Protect your site before it’s hackedManaged security with WAF, scanning and unlimited cleanups.Get a free security scan →

Affordable protection

A CDN and WAF such as Cloudflare, Fastly or AWS WAF absorbs traffic at the edge. Add rate limiting for heavy endpoints like search and login, and make sure your origin IP isn’t publicly exposed.

Common mistakes to avoid

✕Waiting until after a breach to act
✕Restoring a backup without fixing the entry point
✕Leaving old plugins, extensions and admin users in place
✕Relying on a single tool instead of layered defences
HOW VISIBI CAN HELP

How we help with security

01ScanFree scan for malware, vulnerabilities and blocklisting.
02Clean & patchEngineers remove threats and close the entry point.
03HardenWAF, 2FA, least privilege and platform hardening.
04MonitorContinuous scanning with unlimited cleanups on our plans.
Get a free security scan →Free · No obligation · Reply within 24 hours

Frequently asked questions

Are small sites really targeted?

Yes — often by automated tools, extortion attempts or competitors.

Is Cloudflare’s free plan enough?

It includes DDoS protection; paid plans add WAF rules and more control.

Can you set this up?

Yes — with zero-downtime DNS cutover.

SA
Reviewed by Saeed Ak · Co-founder & CTO25 years engineering high-traffic ecommerce, cloud and security platforms. Written by the VISIBI Security team.Meet the team →
Was this guide helpful?
Share:LinkedInXEmail
RELATED SERVICES

Keep reading

SECURITY · 9 MINHow to stop spam and bot attacks on Adobe Commerce CloudRead →SECURITY · 9 MINWordPress security checklist: 15 steps to protect your site in 2026Read →SECURITY · 8 MINMagecart and card skimming: how to protect your checkoutRead →
FREE · NO OBLIGATION

Protect your site before it’s hacked

Managed security with WAF, scanning and unlimited cleanups.

Get a free security scan →Talk to a specialist
✓ Senior specialist, not a bot✓ Reply within 24 hours✓ Clients in 18 countries
SECURITY SCAN PREVIEWEXAMPLE
What attackers can see right now
Unpatched vulnerabilities6
Unknown checkout scripts2
Blocklist statusClean
Your free review shows your real numbers.