I find myself constantly telling people that will listen. If you have a website hosted using WordPress or self-host your website in your infrastructure, there is no excuse not to use Cloudflare. Having a website deployed and sitting out there without any DDoS protection is foolish. Their free offering is robust enough to protect you against one of the simplest and most common attacks out there on the internet.
Cloudflare Saves The Day
Over the weekend, Cloudflare, a cloud-based WAF/DDoS mitigation vendor, reported that its customers experienced a massive wave of volumetric attacks designed to flood their websites with HTTP requests. These attacks were some of the largest ever seen, with the largest exceeding 71 million requests per second (rps), more than 35% higher than the previous record of 46 million rps in June 2022. The attacks were “hyper-volumetric,” launched from over 30,000 IP addresses, and primarily targeted popular gaming providers, cryptocurrency companies, hosting providers, and cloud computing platforms. Interestingly, these attacks originated from cloud computing ecosystems, which is a recent trend in DDoS attacks. In short, compromised hosts in Microsoft Azure, Amazon Web Services, or Google’s Cloud Platform were the originating IPs for this attack.
It is worth noting that volumetric attacks are the least common form of DDoS, with far fewer seen than application-layer and protocol attacks. However, Cloudflare warned that HTTP DDoS attacks had increased by 79% YoY in Q4, with the amount of volumetric attacks exceeding 100 Gbps growing by 67% QoQ and the number of attacks lasting more than three hours increasing by 87% QoQ. The audacity of attackers has also been increasing, with ransom-extracting DDoS attacks steadily increasing throughout the year, peaking in November 2022, where one out of every four surveyed customers reported being subject to Ransom DDoS attacks or threats.
DDoS-for-hire services have made it relatively easy for threat actors to launch attacks today, and as Cloudflare explained, “the more you pay, the larger and longer of an attack you’re going to get.” This underscores the importance of organizations taking proactive steps to secure their online infrastructure and guard against these types of attacks.
What Can I Do To Protect My Website Against DDoS Attacks?
Whether or not you are a target of DDoS attacks is irrelevant. At some point, your website has been swept, and at some point, you will find yourself patching vulnerabilities or dealing directly or indirectly with a DDoS attack. Here are some things that you can do today:
- Sign up for and set up Cloudflare.
- Make sure that proxying is enabled for your website by changing the icon from grey to orange in the DNS control panel in Cloudflare’s web UI.
- Contact your MSP or Web Developer if you have issues with implementing Cloudflare.