A DDoS (Distributed Denial of Service) attack can take down an SMB's website in minutes, regardless of company size or industry. In the case documented here, a footwear distributor in León, Guanajuato lost over $80,000 MXN in sales in 72 hours because its online store was offline during El Buen Fin — Mexico's biggest shopping event of the year.
Context: E-Commerce in León, the Shoe Capital
León is the world capital of leather footwear. With more than 1,000 companies across the sector's value chain, the city has a rapidly growing e-commerce presence: mid-sized workshops that once sold only to wholesalers are now reaching consumers directly through online stores.
The affected company — let's call it "León Calzado Distributor" — had launched its WooCommerce store 8 months before the incident. It had a catalog of 340 models, MercadoPago integration, and averaged 1,200 daily visitors. Its hosting plan was standard shared hosting from a national provider, with no active DDoS protection.
How the Attack Unfolded
The attack began on the Tuesday before El Buen Fin at 2:14 AM. The first symptoms the team noticed were:
- The site started loading extremely slowly around 6 AM.
- At 8:30 AM the hosting provider issued an excessive resource usage alert and temporarily suspended the account.
- When reactivated, the attack resumed and saturated the server again within 40 minutes.
- The hosting provider, lacking DDoS mitigation capabilities, permanently suspended the account to protect other clients on the shared server.
The attack vector was a volumetric HTTP flood: hundreds of thousands of fake requests per second targeting the shopping cart — the most resource-intensive route in a WooCommerce installation. Traffic originated from a botnet distributed across multiple countries.
Direct Consequences
- 72 hours of total downtime during the three highest-demand days of the year.
- Estimated loss of $80,000–$95,000 MXN in direct sales.
- SEO ranking drop: Google detected the site as down and reduced its search visibility.
- Negative reviews on Facebook and Google from customers who couldn't complete orders.
- Emergency migration to a new provider: $3,200 MXN in additional technical costs.
Post-Mortem: What Went Wrong
Reviewing the incident with the technical team that handled the emergency migration revealed four failure points:
1. Shared Hosting With No DDoS Protection
On shared hosting, all sites on the server share the same IP and the same resources. A volumetric attack against one site saturates the entire server, forcing the provider to suspend the targeted account to protect everyone else. The provider didn't fail — it's a structural limitation of the shared hosting model.
2. No CDN or Traffic Absorption Layer
The store's server IP was publicly exposed in DNS. Without a CDN like Cloudflare in proxy mode, attack traffic hit the origin server directly with no intermediate filter.
3. No Business Continuity Plan
There was no documented procedure for when the site went down. The team spent 6 hours determining it was an attack rather than a configuration problem. Those are lost sales during El Buen Fin.
4. No Abnormal Traffic Alerts
Free tools like UptimeRobot would have detected the outage within minutes. Without automated monitoring, the team found out through customer messages on social media.
The Solutions That Were Implemented
The emergency migration and resulting architecture cost approximately $4,800 MXN total — less than 6% of the lost sales. Here's what was done:
| Solution | Tool | Approx. monthly cost |
|---|---|---|
| CDN + basic DDoS protection | Cloudflare (free plan) | $0 |
| Hosting with active DDoS protection | VPS with specialized provider | $320 – $600 MXN |
| Uptime monitoring | UptimeRobot (free plan) | $0 |
| WAF (web application firewall) | Cloudflare WAF (included in Free) | $0 |
| Cloudflare "Under Attack" mode | Manual or automatic activation | $0 (included) |
Step-by-Step: The Resulting Architecture
- DNS pointing to Cloudflare in proxy mode — the real server IP stays hidden; attack traffic is absorbed by Cloudflare before reaching the origin.
- Cloudflare firewall rules — blocking countries with no purchase history, rate limiting on cart routes (
/cart,/checkout). - VPS with full server control — on shared hosting you can't install custom firewall rules; on a VPS you can.
- DNS failover — a static maintenance page hosted on Cloudflare Pages activates automatically if the origin goes down.
- UptimeRobot alerts — WhatsApp and email notification if the site doesn't respond within 1 minute.
Cloudflare, even on its free plan, can absorb volumetric attacks of hundreds of Gbps. For most SMBs in León or any Mexican city, the free plan is more than enough to withstand attacks targeting local commerce sites.
If your business needs an evaluation of its current infrastructure and a protection plan, the team at elenlace.com can help you configure these layers without requiring advanced technical knowledge on your end.
For broader context on how SSL and security layers work together in these kinds of architectures, explore our SSL security and web protection resources for Mexican businesses.
Key Takeaways
- DDoS attacks aren't exclusive to large companies — an SMB with moderate traffic can be targeted through extortion, unfair competition, or random mass campaigns.
- Standard shared hosting has no DDoS mitigation capability; the provider will suspend the account to protect other customers.
- Cloudflare in proxy mode is the most accessible first line of defense for any business, even on the free plan.
- Uptime monitoring (UptimeRobot) is free and can cut hours off response time when an outage occurs.
- A documented continuity plan can mean the difference between 6 hours of downtime and 72 hours of downtime.
- The cost of proper DDoS protection ($0–$600 MXN/month) is minimal compared to the losses from a single incident.
Don't wait to lose $80,000 MXN in sales before taking action. Contact us at elenlace.com and we'll review your current infrastructure to implement DDoS protection before your next peak season.
FAQ
Why would anyone attack a small SMB in León?
The most common motives are: extortion (demanding payment to stop the attack), unfair competition, or the site being randomly included in a mass attack campaign. Many botnets attack entire IP ranges without regard for the target's size.
Is the free Cloudflare plan enough for a mid-sized WooCommerce store?
For most cases, yes. Cloudflare's free plan includes unlimited L3/L4 DDoS protection and a basic WAF. For more sophisticated Layer 7 (HTTP) attacks, the Pro plan (~$20 USD/month) offers more detailed WAF rules. A WooCommerce store with fewer than 5,000 daily visitors is generally well protected by the free plan.
How long does Cloudflare protection take to activate after updating DNS?
DNS propagation can take between 5 minutes and 48 hours, though in practice it usually completes in under 2 hours. Cloudflare provides its own nameservers that allow faster propagation. "Under Attack" mode can be activated manually from the dashboard at any time — even while an attack is ongoing.
Can a DDoS attack steal my customers' data?
A DDoS attack targets availability — taking the site down — not data theft. However, some attackers use DDoS as a distraction while running a simultaneous secondary attack. That's why DDoS protection should be paired with a WAF and general security best practices (SSL, plugin updates, strong passwords).
Compare providers
Other providers and guides worth comparing:
