“DDoS” gets thrown around constantly in hosting and security marketing, usually without anyone actually explaining what it means. If your site has ever gone down suddenly with no clear cause, or you’ve just seen the term and wondered what it actually describes, here’s the plain-English version no assumed technical background required.
The Basic Idea, in One Sentence
A DDoS attack works by sending a website far more traffic than its server can handle at once, so the server becomes overwhelmed and stops responding to anyone including your real visitors.
That’s genuinely the core of it. Everything else is detail about how that flood gets created and why it’s harder to stop than it sounds.
Why It’s “Distributed”
The “D” that comes before “DoS” (Denial of Service) stands for Distributed meaning the flood of traffic doesn’t come from one computer, it comes from thousands or even millions of devices at once, often spread across many countries. These devices are frequently ordinary computers, routers, or smart devices that have been infected with malware without their owners’ knowledge, forming what’s called a botnet.
This is why blocking “the attacker’s IP address” doesn’t work as a defense there isn’t one attacker’s IP, there are potentially millions of them, each sending a small amount of traffic that adds up to an overwhelming total.
What Your Server Actually Experiences
Think of your web server like a single checkout counter at a store, built to comfortably handle a normal flow of customers. A DDoS attack is the equivalent of tens of thousands of people suddenly trying to walk through that one checkout counter at the same second. It’s not that any individual “customer” is doing anything unusual — it’s that the sheer volume physically cannot be processed, so the line stops moving entirely, and genuine customers can’t get through either.
Technically, this happens because every request to your server consumes a small amount of resources processing power, memory, bandwidth. A normal amount of traffic uses a normal amount of these resources. A flood of attack traffic exhausts them entirely, leaving nothing left to serve real visitors.
The Different “Flavors” of DDoS Attacks
Not all DDoS attacks work the same way. Broadly:
- Volume-based attacks — simply flooding your connection with as much raw traffic as possible, aiming to saturate your bandwidth
- Protocol attacks — exploiting weaknesses in how servers handle connection requests, tying up server resources with incomplete or malformed connections rather than raw volume
- Application-layer attacks — mimicking normal-looking requests (like loading a page or submitting a form) but at a volume and speed no real user could produce, which is harder to distinguish from legitimate traffic
This last category is often the trickiest to defend against, because the traffic doesn’t look obviously malicious at a glance — it looks like a lot of people visiting at once, just far too many, far too fast.
Why You Often Can’t “Just Block It” Yourself
The instinct is to think a firewall on your own server should handle this. The problem is that by the time attack traffic reaches your server, the damage is already happening your connection and resources are already being consumed. Blocking traffic at that point is like trying to control a crowd after they’ve already crammed through the door; the congestion has already occurred.
This is why effective DDoS protection works before traffic reaches your server, not after filtering and absorbing the flood at a separate layer with far more capacity than any single website’s server, so only clean traffic ever reaches your actual site.
How Proxy-Based Protection Actually Stops This
This is the core function of a service like Cloudflare sitting in front of a website: instead of traffic going directly to your server, it goes to a globally distributed network built specifically to absorb massive traffic volume, get filtered, and only pass along legitimate requests. Your server never sees the flood at all it just sees the clean traffic left after filtering.
During an active attack, Under Attack Mode adds an extra layer on top of this a brief automated check in front of every visitor, which filters out the automated, script-driven requests common in DDoS traffic while still letting real humans through with minimal friction.
Why “Unmetered” Protection Matters
One detail worth understanding: DDoS protection that caps out at a certain traffic volume defeats the purpose, since the entire nature of an attack is unpredictable, potentially massive volume. This is why unmetered DDoS protection — protection with no traffic ceiling is table stakes rather than a premium feature; it’s included as standard across every Tremhost Armor tier, from Lite through Business, because there’s no version of “DDoS protection” worth having if it can itself be overwhelmed.
What This Means Practically for Your Site
| If your site… | Then… |
|---|---|
| Has no proxy/firewall layer | Traffic — including attack traffic — hits your server directly, with no filtering |
| Has basic proxy protection (Armor Lite) | Baseline filtering and unmetered DDoS protection are already active |
| Has tuned WAF and rate limiting (Armor Pro) | Application-layer attacks mimicking real traffic are filtered more precisely |
| Is actively under attack right now | Under Attack Mode can be activated immediately — this is where Armor SOS comes in for sites without existing protection |
Understanding what’s actually happening during an attack makes the value of this kind of protection much less abstract it’s not a marketing checkbox, it’s the difference between traffic being absorbed upstream versus your server trying to survive a flood it was never built to handle alone.
