---
title: DDoS
canonical: https://wpsecurityninja.com/dictionary/ddos/
---
# DDoS

A DDoS attack floods a site or its infrastructure with traffic so legitimate visitors cannot get through.

## Why it matters for WordPress

Even a cheap flood can knock shared hosting offline. Application-layer floods aim at login, search, XML-RPC, or heavy plugin endpoints so a little traffic does a lot of damage. A security plugin alone cannot absorb a large network flood; that belongs at the CDN or host edge.

## How it shows up in practice

- Timeouts while CPU or network is pegged
- Huge request rates to one URL or to missing paths (404 storms)
- Host or CDN abuse notices
- A flood that hides a quieter intrusion attempt underneath

## What to do

1. Put the site behind a CDN or host WAF that absorbs volumetric noise.
2. Rate-limit login, XML-RPC, and other expensive endpoints.
3. Cache aggressively for anonymous traffic.
4. Work with the host when the flood is bigger than the app can handle.
5. After it calms down, check whether someone also tried to break in.

## In WP Security Ninja

Large volumetric floods belong at the CDN or host edge. On the application side, [Cloud Firewall](https://wpsecurityninja.com/cloud-firewall/) can cut known-bad IPs, countries you do not serve, and exploit-shaped requests. [404 Guard](https://wpsecurityninja.com/404-guard/) helps with noisy probe traffic that hammers missing URLs. Neither replaces an edge DDoS service for a big network flood.