Our sites are getting periodic DDoS attacks, 80% of traffic is blocked — what can I do?

we switced to cloudflare, no issues now. costs 20 usd monthly and i don't get ddos attack alerts anymore. anyway site speed improved too

edit: I wrote something wrong above, sorry about that.

DDoS protection + WAF are separate things. DDoS = block at traffic level. WAF = filter bad requests at request level.

seriously test the ddos attack is it really ddos or just bot traffic? anyway open dnschecker.org or something, check the ip address range

Quick fix: switch to Cloudflare, set it up (1 hour). Let protection start. Then make structural decisions.

the site getting attacked pays the hosting company, then pays extra to stop the attack then that's just how the world works

folloing but hasty decisions become decisions you have to fix six months later.

I went through the same thing.

You're right. Security isn't absolute; it's about making attacks not worth the effort.

Security isn't absolute; it's about making attacks not worth the effort. I'm also curious if anyone does it differently.

Correct. Everything goes well for the first three months; problems arise in the fourth.

If you scold false alarms, nobody will report again. I'm also curious if anyone does it differently.

im in the same situation thats why Im asking then honestly most incidents start with a leaked password not a vulnerability.

start with a small trial; don't commt to everything at once.

There's a common mistake people make when doing this. When making decisions, write down the worst-case scenario too, not just the best.

This is my opinion, I'm not claiming it's absolute truth.

I can't fully agree with this. The real issue isn't the number, but what it's based on.

Proven by experience.

Let me share what happened to me; it might be useful. Most time waste accumulates in tasks waiting for approval.

Of course, it varies if your situation is different.

I'm in the same situation, that's why I'm asking. Just because everyone does it doesn't mean it's right.

That's all, sorry if I went on too long.

I have a question. Your time to detect an issue directly determines its cost.

I didn't know that.

To get into the details: Start with a small trial; don't commit to everything at once.

If you post the result here, it will help others too.

Thanks a lot, I'll try it today. Everyone rushing into ddos protection gets stuck at the same point.

When you try to change everything at once, nothing settles. This is my opinion, I'm not claiming it's absolute truth.