DDoS attacks explained: what they are and how to reduce the risk
A DDoS attack tries to make a service unavailable by flooding it with more traffic than it can handle. Game servers and community sites are common targets, usually because of a grudge, a rivalry or boredom rather than money. Understanding how these attacks work helps you stay calm, take sensible precautions and avoid common myths.
What DDoS means
DoS stands for denial of service. The D at the start means distributed: the traffic comes from thousands of devices at once, often hijacked computers or misused internet services, so you cannot block it by banning a single address.
The goal is simple: use up something your server needs, such as bandwidth, processing time or connection slots, until real users cannot get through.
The main types
| Type | What it overwhelms | Example |
|---|---|---|
| Volumetric | Network bandwidth | A flood of UDP packets that fills the connection |
| Protocol | Network devices and connection tables | SYN floods that exhaust half-open connections |
| Application | The program itself | Thousands of login or search requests per second |
Volumetric attacks are the loudest. Application attacks are quieter but can take a small site down with surprisingly little traffic, because each request costs the server real work.
Signs you are being attacked
- Sudden lag or disconnections for everyone at once, not one player.
- Your server is running, but nobody can connect.
- Extremely high network traffic compared to your normal pattern.
- Very high CPU use from a web server or game process with no extra players.
- A flood of similar requests from many addresses in your logs.
Do not jump to conclusions. Lag has many ordinary causes, such as a heavy plugin, an overloaded machine or a problem on one player's network. Check first with Understanding TPS and MSPT and How to fix server lag, and read your logs, as in How to read your server logs.
What you can do yourself
Hide your real address
Attackers need your server's IP address. Do not post it publicly if you can avoid it, and use a domain name instead. Be careful about who learns it, because many attacks start when a hostile player finds the address. See How to connect a domain to your server.
Use a proxy for websites
For websites, a reverse proxy or content delivery network sits in front of your server and absorbs a lot of junk traffic, so the origin stays hidden. Lock your origin so it only accepts connections from the proxy. Note that game traffic usually cannot pass through a typical web proxy.
Lock down your firewall
Only open the ports you need. Rate-limit new connections where possible. Set up a firewall on your VPS with UFW covers the basics, and How game server ports work explains which ports a game needs.
Make the application cheaper to attack
Cache pages, put limits on expensive actions such as searches and logins, and add rate limiting in your web server. Slow, heavy pages are the easiest application-layer targets. Add Fail2ban to ban abusive addresses automatically.
Keep software current
Some attacks abuse bugs rather than volume. Turn on automatic security updates and keep your game server and plugins updated, as in Keep your game server updated.
Control who can join
Whitelists and verification stop attackers from using your own server's login system as a weapon. See Whitelist players and OP permissions.
What you cannot do yourself
A large flood saturates the network link before it reaches your machine. No setting on your server can fix that, because the damage happens upstream, where your provider or an upstream network must filter it. This is why hosting providers run network-level protection. If you suspect a large attack, contact support quickly with the time it started and a description of what you see. How to write a support request lists what to include.
What not to do
- Do not pay attackers or negotiate. It rarely ends the problem.
- Do not retaliate. Attacking back is illegal in most places and often hits an innocent, hijacked device.
- Do not publish your address while under attack, asking for help.
- Do not assume every lag spike is an attack. Rule out ordinary causes first.
- Do not buy "stress testing" services. They are the same tools, often illegal to aim at others.
Keep records
If you are attacked repeatedly, write down the times, symptoms and any logs. It helps support, and may help if you need to report it. Serious or repeated attacks can be reported to your local authorities.
After an attack
- Check the server's integrity: look for changed files and unknown accounts.
- Review logs for any attempt to exploit software.
- Rotate secrets if you suspect more than a flood.
- Tighten what let it through, whether an exposed address or a heavy endpoint.
- Make sure backups are current. See The 3-2-1 backup rule.
Staying prepared is mostly ordinary good hygiene: keep addresses private, close unused ports, keep software patched and have a plan for contacting support.
Still stuck? Open a ticket on Discord - run /ticket in any channel, pick a department, and include your Server ID or Invoice ID so we can jump straight in.