Site under attack? Let's get it back up.

Five steps, in this order

1. Confirm it is an attackIn the server logs look for a spike of requests from a few IPs, from the same country or always to the same page (often /wp-login.php, search or the cart). A sudden jump with no campaign or viral article behind it is the typical sign.
2. Put the site behind the CDNWith 1PrimeCDN traffic reaches our nodes instead of your server: the cache answers for you and Shield stops bots before they reach you. You only need to change the domain's nameservers, or a single DNS record.
3. Turn on «Under attack» modeIn the panel, Security → the zone's «Under attack» switch: every visitor goes through a one-second automatic check. People barely notice, bots making thousands of requests stay out, verified Google and Bing crawlers still get through.
4. Block the countries and IPs the attack comes fromIf the attack comes from a few countries where you have no customers, block them or send them through the check. IPs that keep hammering are blocked automatically, with expiry and reason visible in the panel.
5. Close the server to everyone except the nodesAs long as your server's IP is reachable, anyone who knows it can attack it directly, bypassing the CDN. In the firewall, leave ports 80 and 443 open only to the node IPs (listed in the panel under Pull Zone → Origin). If the IP is already known, consider changing it.

What we stop and what we don't

1PrimeCDN Shield is designed for attacks that hit the website (layer 7): HTTP request floods, bots, scrapers, bursts of login attempts. Very large network attacks are filtered earlier, by the anti-DDoS protection included in the data centres of our nodes (OVHcloud and Hetzner). If an attack is exceptionally large, we'll tell you plainly and help you find the right solution.

Should I report it?

A DDoS attack is a crime. Keep the logs and times, then report it to your national police cybercrime unit. Never pay anyone who asks for a ransom to stop the attack: another one usually follows.