DDoS (Distributed Denial of Service) protection involves deploying infrastructure, services, and configurations that detect and mitigate flood attacks designed to overwhelm your website or application with malicious traffic. For Indian businesses—where CERT-In reported a 300%+ increase in DDoS attacks targeting Indian infrastructure between 2022-2025—implementing layered DDoS protection through CDN-based mitigation (Cloudflare, AWS Shield), rate limiting, WAF rules, and ISP-level filtering can mean the difference between minutes of disruption and days of costly downtime. Last updated October 2026.
What Is a DDoS Attack and How Does It Work?
A DDoS attack floods your server or network with traffic from thousands or millions of compromised devices (a botnet), overwhelming its capacity to serve legitimate users. Types of DDoS attacks:
| Attack Type | Layer | Mechanism | Example |
|---|---|---|---|
| Volumetric | Network (L3/L4) | Floods bandwidth | UDP flood, DNS amplification, NTP reflection |
| Protocol | Network (L3/L4) | Exploits protocol weaknesses | SYN flood, Ping of Death, Smurf attack |
| Application | Application (L7) | Targets specific services | HTTP flood, Slowloris, API abuse |
Modern DDoS attacks are often multi-vector—combining volumetric, protocol, and application layer attacks simultaneously to overwhelm different defences.
How Can Indian Businesses Protect Against DDoS Attacks?
Layer 1: CDN and Cloud-Based DDoS Mitigation
The most effective first line of defence is a cloud-based DDoS mitigation service that absorbs attack traffic before it reaches your server:
- Cloudflare: Free tier includes basic DDoS protection; Pro (₹1,600/month) adds WAF and advanced DDoS; Business (₹16,000/month) and Enterprise (custom pricing) for guaranteed uptime SLAs. Cloudflare’s Indian PoPs (Mumbai, Chennai, New Delhi, Kolkata, Hyderabad, Bengaluru) ensure low latency for legitimate traffic.
- AWS Shield: Standard (free with AWS) protects against common volumetric attacks. Advanced (₹25,000/month + data transfer costs) provides 24/7 DDoS Response Team support and financial protection against scaling costs during attacks.
- Akamai Prolexic: Enterprise-grade DDoS mitigation with dedicated scrubbing centres. Custom pricing for Indian enterprises, typically ₹5-20 lakh/month.
- Google Cloud Armor: Integrated with Google Cloud Load Balancing, provides L3-L7 DDoS protection. Pay-per-rule pricing makes it cost-effective for Google Cloud users.
Layer 2: Web Application Firewall (WAF)
A WAF protects against application-layer (L7) DDoS attacks that bypass network-level defences:
- Rate limiting: Restrict requests per IP per time window. A legitimate user might make 60 requests/minute; an attacker makes thousands.
- Bot management: Distinguish legitimate users, good bots (Googlebot), and malicious bots. Challenge suspicious requests with CAPTCHAs or JavaScript challenges.
- Geographic filtering: If your business serves only Indian customers, block or challenge traffic from regions with high bot activity.
- Custom rules: Block specific attack patterns, malicious user agents, and known bad IP ranges.
Layer 3: Server and Network Hardening
- SYN cookies: Enable on your Linux server (
net.ipv4.tcp_syncookies = 1) to protect against SYN flood attacks. - Connection limits: Configure Nginx/Apache to limit concurrent connections per IP (e.g.,
limit_conn_zonein Nginx). - Disable unnecessary services: Close unused ports. A common misconfiguration on Indian servers is leaving SSH on port 22 open to the world—move to a non-standard port and use key-based auth.
- ISP-level filtering: For large enterprises, coordinate with your ISP (Airtel Business, Jio, Tata Communications) for upstream filtering of known attack traffic.
DDoS Incident Response Plan
- Detection (0-5 minutes): Monitoring alerts trigger—sudden traffic spike, server response time increase, or availability drop. Cloudflare/AWS Shield generate automatic alerts.
- Assessment (5-15 minutes): Determine attack type, volume, and source patterns. Check if mitigation is automatic or requires manual intervention.
- Mitigation (15-30 minutes): Activate DDoS mitigation mode (Cloudflare “Under Attack” mode), tighten WAF rules, implement emergency rate limits.
- Communication (concurrent): Notify stakeholders, update status page, inform CERT-In if the attack is significant.
- Post-attack (24-48 hours): Analyse attack logs, update permanent rules based on attack patterns, document lessons learned.
Cost of DDoS Protection for Indian Businesses
| Business Size | Recommended Stack | Monthly Cost |
|---|---|---|
| Small (blog, portfolio) | Cloudflare Free + server hardening | ₹0 |
| SME (business website, small e-commerce) | Cloudflare Pro + basic WAF rules | ₹1,600-₹5,000 |
| Mid-market (high-traffic e-commerce, SaaS) | Cloudflare Business + AWS Shield Standard | ₹16,000-₹50,000 |
| Enterprise (banking, large e-commerce) | Cloudflare Enterprise or Akamai + AWS Shield Advanced | ₹1,00,000-₹25,00,000 |
Frequently Asked Questions
Can Cloudflare’s free plan really stop DDoS attacks?
Yes, for most small to medium volumetric and protocol attacks. Cloudflare’s free tier includes “unmetered DDoS mitigation”—they absorb attack traffic across their global network without charging extra. However, the free plan lacks advanced WAF rules, bot management, and guaranteed response times. For business-critical sites, the Pro plan (₹1,600/month) provides significantly better protection.
How long do DDoS attacks typically last?
Most DDoS attacks in 2025-2026 lasted under 30 minutes, as automated botnets move between targets. However, targeted attacks against specific Indian businesses (often competitors or extortion attempts) can last hours or days. Multi-vector attacks that adapt when one vector is blocked can persist for weeks if defences are inadequate.
Is DDoS protection required by Indian regulations?
While no Indian regulation explicitly mandates DDoS protection, CERT-In’s cybersecurity directives require organisations to implement “appropriate security practices” and report DDoS incidents within 6 hours. RBI mandates that banks and financial institutions have DDoS mitigation in place. The IT Act holds organisations liable for negligent security practices that lead to data breaches or service disruptions.
Can my hosting provider protect against DDoS?
Most Indian shared hosting providers offer minimal DDoS protection—they may null-route your IP (take your site offline) during an attack to protect other customers on the same server. Quality hosting providers (AWS, DigitalOcean, Linode) include basic infrastructure-level protection. For reliable DDoS defence, add a dedicated solution like Cloudflare in front of any hosting provider.
What should I do if I receive a DDoS extortion email?
Do not pay. DDoS extortion emails are common, and many are empty threats sent to thousands of businesses. Instead: (1) verify your DDoS protection is active and properly configured, (2) report the threat to CERT-In (incident@cert-in.org.in), (3) file a police complaint at your local cyber crime cell, (4) alert your hosting provider and DDoS mitigation service. If an actual attack follows, your mitigation infrastructure should handle it.
