--- title: "Knocked down, not hacked: DDoS explained · Wi24rd" description: "A denial-of-service attack is not a break-in. Understand the difference, and set up Cloudflare’s free DDoS shield, alert and Under Attack Mode – step by step, about 15 minutes." url: "https://wi24rd.com/en/security-tips/ddos/" lang: "en" alternates: da: "https://wi24rd.com/sikkerhedstips/ddos/" en: "https://wi24rd.com/en/security-tips/ddos/" --- Security tip 9 · DDoS # Knocked down, not hacked. When the news says a bank or a council "has been hacked", it is often a denial-of-service attack: the site was hard to reach for a few hours, but nobody got in. Here is the difference – and what you can do yourself, free with Cloudflare. Last checked 1 November 2026 [Go to the steps](https://wi24rd.com/en/security-tips/ddos/#trin)[When it happens](https://wi24rd.com/en/security-tips/ddos/#naar) Time ~15 min once the domain is behind Cloudflare Price Free with no cap on attacks Protects Websites behind the orange cloud Needs Orange cloud domain behind Cloudflare, see tip 3 What it is ## A thousand fake customers in the doorway. Imagine a shop where a thousand people suddenly crowd the doorway without wanting to buy anything. The real customers cannot get in. Nobody has stolen anything and the shelves are untouched, but the shop is closed for as long as the crowd stands there. That is a DDoS attack: _distributed denial of service_. The crowd is thousands of hijacked computers, routers and cameras – a botnet – all sending requests at the same time. It needs no access to your systems, only that the website can be reached from the internet. Attacks can be rented for little money, and they are often used as a political statement, because they make a lot of noise and cost little. **Overload or break-in?** DDoS The site is hard to reach while it lasts. Nobody has been inside, and nothing is stolen. It comes back once the attack stops. Hacked Someone has gained access: data is copied, changed or encrypted. It can go on for weeks before anyone notices. Three questions for the article: Was data stolen? Has someone been inside? Or was the site just hard to reach? If the answer is only yes to the last, it was overload. A Danish example ## Down is not the same as broken into. In November 2025, borger.dk and the Danish Ministry of Transport’s website, among others, were down after DDoS attacks that a pro-Russian group claimed. The defence company Terma was also hit and said there had been no security breach and no data was lost. It was serious for the people who needed the sites – but it was not a break-in. Why does the word matter? Because "hacked" makes people change passwords and fear for their data, while what actually works against DDoS is something else entirely: a shield in front of the website. **The honest exception** A denial-of-service attack can be used as a smokescreen: while everyone looks at the downed front page, someone tries to get in through another door. That is why a look at the logs and login attempts belongs on [the checklist](https://wi24rd.com/en/security-tips/ddos/#naar), even when it is "just" DDoS. See where attacks on Denmark come from right now in [Denmark right now](https://wi24rd.com/en/machine-room/denmark/). Step by step · Cloudflare ## Six steps, about 15 minutes. 1. ### Sit behind the orange cloud – and close the back door DDoS protection only works on traffic that goes through Cloudflare. Follow [tip 3](https://wi24rd.com/en/security-tips/cloudflare-proxy/), and let the server only accept traffic from Cloudflare. If an attacker knows the server’s real address, the attack goes around it. 2. ### Check that the shield is on There is no button to press: the protection is always on and has no cap on how large an attack it takes – on the free plan too. Under **Security → Settings** you can search for _DDoS attack protection_ and see the three layers listed as **Always active**. [!\[Three DDoS layers – HTTP, network and SSL/TLS – all with status Always active\](https://wi24rd.com/assets/img/skaerm/ddos-lag.webp)](https://wi24rd.com/assets/img/skaerm/ddos-lag.webp) _Security → Settings: all three layers show as Always active on wi24rd.com’s free plan. Screenshot from wi24rd.com’s Cloudflare account, November 2026._ 3. ### Get an email when it happens Under **Notifications** (in the menu _Observability → Alerts → Platform Notifications_), press **Create a notification** and choose **HTTP DDoS Attack Alert**. It is available on all plans and sends an email when Cloudflare mitigates an attack above 100 requests per second. Then you hear it from Cloudflare and not from the news. [!\[The notification HTTP DDoS Attack Alert with status Enabled\](https://wi24rd.com/assets/img/skaerm/ddos-alarm.webp)](https://wi24rd.com/assets/img/skaerm/ddos-alarm.webp) _wi24rd.com has one DDoS alert covering all domains in the account. Screenshot from wi24rd.com’s Cloudflare account, November 2026._ 4. ### Know the emergency button On the domain’s **Overview**, **Under Attack Mode** sits under _Quick Actions_ on the right. When on, every visitor gets a short browser check before the page is shown – the robots in the crowd drop out, real people get through after a few seconds. Only use it when an attack actually gets through, and switch it off again afterwards. Cloudflare itself calls it a last resort. [!\[Quick Actions with the Under Attack Mode switch off\](https://wi24rd.com/assets/img/skaerm/ddos-under-attack.webp)](https://wi24rd.com/assets/img/skaerm/ddos-under-attack.webp) _The switch is on the domain’s Overview. Day to day it is off. Screenshot from wi24rd.com’s Cloudflare account, November 2026._ 5. ### Or only on the vulnerable pages If only the login or the contact form is being hit, the emergency button can be set on just those paths. Under **Rules → Configuration Rules**, create a rule that matches the path and switch **I’m Under Attack** on. The rest of the site carries on without the interstitial. [!\[Configuration Rule with an expression matching the paths /kontakt and /en/contact\](https://wi24rd.com/assets/img/skaerm/ddos-regel.webp)](https://wi24rd.com/assets/img/skaerm/ddos-regel.webp) _The rule matches only the contact pages. The expression can be typed directly with _Edit expression_. Screenshot from wi24rd.com’s Cloudflare account, November 2026._ [!\[The setting I’m Under Attack switched on in the rule\](https://wi24rd.com/assets/img/skaerm/ddos-regel-til.webp)](https://wi24rd.com/assets/img/skaerm/ddos-regel-til.webp) _Further down the rule: I’m Under Attack switched on. The rule is shown as an example and not saved on wi24rd.com. Screenshot from wi24rd.com’s Cloudflare account, November 2026._ 6. ### Let Cloudflare answer for the server A page Cloudflare can deliver from its cache does not ask the server at all – and a site without a server, as in [tip 7](https://wi24rd.com/en/security-tips/static-sites/), has no server to take down. For forms and login, the free plan gives one **rate limiting** rule that slows down an IP address sending too many requests in 10 seconds. When it happens ## Five things, in this order. 1. ### Confirm it Under **Security → Analytics** you can see whether traffic has exploded and how much Cloudflare is already stopping. A slow site can also be a fault on your own side. 2. ### Switch on the emergency button If the attack gets through, switch on Under Attack Mode – for the whole domain or only for the paths being hit. 3. ### Look for a break-in Check login attempts, admin accounts and logs. This is where a smokescreen would show. 4. ### Say it as it is "The site is overloaded by an attack. No data is affected." Only write the last part once you have checked it. 5. ### Clean up afterwards Switch Under Attack Mode off when the attack is over, and keep times and screenshots if you want to report it to the police. Honest about the limits ## What the shield does not do. - **It only covers what goes through Cloudflare.** Mail, VPN and a server with a known address can still be hit directly. - **It does not protect your internet connection.** If the site runs on a server at home, the line itself can fill up. [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/) hides the address, so the attack hits Cloudflare instead. - **The emergency button has a price.** Under Attack Mode requires JavaScript and can stop RSS readers, monitoring and other machines that need to fetch the site. That is why it is off day to day. **About this tip** The settings were checked in wi24rd.com’s Cloudflare account on 1 November 2026, and the November 2025 example is based on AFP’s coverage of the attacks. The steps follow [Cloudflare’s own guide](https://developers.cloudflare.com/fundamentals/reference/under-attack-mode/). The man behind Wi24rd has used Cloudflare himself since he saw them at Black Hat in London in 2015. Wi24rd has no financial interest in Cloudflare – no money, discounts or services. [All security tips](https://wi24rd.com/en/security-tips/) [See the figures live](https://wi24rd.com/en/right-now/) [Back to Security tips](https://wi24rd.com/en/security-tips/)[To the top](https://wi24rd.com/en/security-tips/ddos/#top) ## Missing a tip? Write what you would like explained. The next security tip could be yours. [Write to Wi24rd](https://wi24rd.com/en/contact/)[The site’s own defences](https://wi24rd.com/en/security/)