When a DDoS attack hits a shared hosting server, your site goes offline in seconds because the resources you share with other users are instantly exhausted. The good news: you can dramatically reduce the impact by activating a CDN with traffic filtering (such as Cloudflare) before an attack ever happens.
What Is a DDoS Attack and Why Is Shared Hosting Especially Vulnerable?
A distributed denial-of-service (DDoS) attack floods your server with millions of fake requests from thousands of compromised machines (a botnet). The goal is to exhaust server resources until it can no longer serve legitimate visitors.
On shared hosting, the impact is twofold:
- Shared resources: CPU, RAM, and bandwidth are divided among all users on the server. An attack aimed at one site can take down its neighbors.
- No root access: you can't configure firewall rules at the OS level on your own — you depend entirely on your host's defenses.
- Automatic account suspension: many providers suspend the targeted account to protect the rest of the server, leaving your site offline even after the attack stops.
What Actually Happens During a DDoS on Shared Hosting
- Malicious traffic hits the server: hundreds of thousands of HTTP requests per second saturate ports 80 and 443.
- The server exhausts its resources: CPU hits 100%, RAM fills up, and the uplink bandwidth is maxed out.
- Neighboring sites go down too: every domain on the same server becomes unreachable.
- The host intervenes: they may apply null-routing (blocking the server's entire IP), throttle connections per source IP, or suspend the targeted account.
- Recovery takes time: even if the attack lasts minutes, recovery can take hours if the provider doesn't have automated mitigation.
How to Protect Your Shared Hosting Site Against DDoS
1. Enable Cloudflare (or a CDN with WAF) as Soon as Possible
This is the single highest-impact move for shared hosting sites. Cloudflare acts as an intermediary, filtering malicious traffic before it ever reaches your server. The free plan already includes basic DDoS protection; Pro and Business plans add a WAF and advanced rules.
To activate it, point your domain's nameservers to Cloudflare. Your hosting server's IP is then hidden behind Cloudflare's network, making direct-to-origin attacks much harder.
2. Keep Your Origin IP Secret
If an attacker discovers your server's real IP, they can send traffic directly, bypassing Cloudflare entirely. Avoid exposing the IP in:
- Historical DNS records (check with tools like SecurityTrails).
- Email headers from mail sent directly from the server.
- SSL certificates issued before you added Cloudflare (Certificate Transparency logs).
3. Set Up Rate Limiting
Cloudflare's rate limiting rules automatically block IPs that exceed a set number of requests per second. Even the free plan lets you create basic rules under Security → WAF → Rate limiting rules.
4. Protect Your Admin Panel
WordPress login pages (/wp-admin, /wp-login.php) and other CMS admin areas are frequent targets of application-layer (Layer 7) attacks. Restrict access by IP allowlist or enable two-factor authentication.
5. Contact Your Hosting Provider
Many providers have incident response teams. During an active attack:
- Open an urgent support ticket stating you're under a DDoS attack.
- Ask them to null-route attacking IPs or activate their DDoS mitigation layer.
- Ask whether they offer a hosting plan with built-in DDoS protection — some providers offer this as an upgrade.
DDoS Protection Options by Budget
| Solution | Approximate cost | Protects against | Best for |
|---|---|---|---|
| Cloudflare Free | $0/month | Basic volumetric attacks (L3/L4) | Blogs, small sites |
| Cloudflare Pro | ~$20 USD/month | L3/L4 + WAF (L7) + advanced rules | Online stores, mid-size portals |
| Host with DDoS protection included | Varies | Depends on provider | Those who prefer all-in-one |
| VPS/Cloud with Anycast network | From ~$10 USD/month | High absorption capacity | High-traffic or business-critical sites |
What to Do If an Attack Is Already Underway
- Enable "Under Attack Mode" in Cloudflare: adds a JavaScript challenge to all visitors. Activate it under Overview → Under Attack Mode.
- Contact your hosting support immediately with the subject "Active DDoS attack" and share any access logs you have.
- Do not try to block IPs manually via
.htaccessduring an active volumetric attack: the traffic comes from thousands of IPs and processing each rule will add more load to an already-struggling server. - Document the attack: save logs, screenshots of traffic, and the start time. This helps your provider and, if needed, authorities.
To compare hosting providers that offer native DDoS protection, browse our hosting comparisons section.
Key Takeaways
- A DDoS on shared hosting doesn't just hurt your site — it can bring down every neighbor on the same server.
- The most effective and affordable preventive measure is putting Cloudflare (or a CDN with WAF) in front of your domain before an attack happens.
- Keeping your origin IP hidden is just as important as having perimeter protection.
- During an active attack, Cloudflare's "Under Attack Mode" and your host's support team are your first lines of response.
- If your site is business-critical, shared hosting may not be enough — a plan with dedicated DDoS protection or a VPS/cloud environment may be the right long-term solution.
Need help choosing the right hosting plan and setting up a solid protection layer? The team at elenlace.com can guide you from evaluation all the way to go-live.
FAQ
Can I stop a DDoS on my own on shared hosting?
Your options are very limited without root access. The most effective thing you can do in the moment is activate Cloudflare's "Under Attack Mode" (if it was already set up) and contact your host's support team. Don't try to block IPs via .htaccess during an active attack — it will worsen server load.
How long does a typical DDoS attack last?
Opportunistic attacks usually last between 5 and 60 minutes. Targeted attacks (extortion, unfair competition) can run for hours or days. Active perimeter protection causes most attackers to give up quickly when they see no impact.
Is the Cloudflare free plan enough to protect me?
For small to medium sites, yes: the free plan mitigates most volumetric network-layer (L3/L4) attacks. If your site handles payments or sensitive data, the Pro plan adds a more powerful WAF for application-layer (L7) attacks, which justifies the cost.
Will my hosting provider notify me if my site is under attack?
It depends on the provider. Some send automatic alerts; others simply suspend the account to protect the server. The most reliable approach is setting up an external uptime monitor (UptimeRobot, Freshping) that notifies you the instant your site stops responding.
Prefer it done for you? El Enlace handles hosting and professional web development.
Useful resources
Other providers and guides worth comparing:
