DDoS
Definition
A DDoS attack floods a site or its infrastructure with traffic so legitimate visitors cannot get through.
Also called: denial of service, distributed denial of service
Why it matters for WordPress
Even a cheap flood can knock shared hosting offline. Application-layer floods aim at login, search, XML-RPC, or heavy plugin endpoints so a little traffic does a lot of damage. A security plugin alone cannot absorb a large network flood; that belongs at the CDN or host edge.
How it shows up in practice
- Timeouts while CPU or network is pegged
- Huge request rates to one URL or to missing paths (404 storms)
- Host or CDN abuse notices
- A flood that hides a quieter intrusion attempt underneath
What to do
- Put the site behind a CDN or host WAF that absorbs volumetric noise.
- Rate-limit login, XML-RPC, and other expensive endpoints.
- Cache aggressively for anonymous traffic.
- Work with the host when the flood is bigger than the app can handle.
- After it calms down, check whether someone also tried to break in.
In WP Security Ninja
Large volumetric floods belong at the CDN or host edge. On the application side, Cloud Firewall can cut known-bad IPs, countries you do not serve, and exploit-shaped requests. 404 Guard helps with noisy probe traffic that hammers missing URLs. Neither replaces an edge DDoS service for a big network flood.
Go deeper
Related in Security Ninja
Related terms
Nearby ideas in the dictionary
- WordPress WAF A WAF filters HTTP traffic to block common web attacks before they reach WordPress.
- Rate limiting Rate limiting caps how often an action can happen from an IP or account, which slows automated abuse.
- XML-RPC XML-RPC is an older WordPress API endpoint attackers often abuse for brute force and amplification.
- 404 scanning 404 scanning is automated probing of missing URLs to find leftovers, backups, and known vulnerable paths.
