So what can you do? The basics of dealing with a DDoS attack are as follows:

  1. Don’t run your server on Windows. It just doesn’t have the tools you need to resist a DDOS attack. You need a Unix-like base.
  2. Pick an ISP who understands that dealing with a DDoS attack is part of their job and not just a reason to shut your site down;
  3. Run your site on a dedicated server. If you share one with many other sites, they’ll all be disrupted so making keeping your site up a much more costly proposition.
  4. Ensure you have root access. You do not want to have to depend totally on the technical resources of your ISP.
  5. Use a DNS service and make sure you have some spare IP addresses. Commercial DNS servers are going to be much more robust than your own, and having spare IP addresses means you can change the IP address of your site pretty quickly. This will be helpful in the event of an attack.
  6. Get a scaleable ISP account and make sure your hardware has spare capacity – you don’t want to run out of headroom the moment an attack begins. 
  7. Be aware: monitor your system so you see attacks early and make sure you have a good back-up system in place.

If you get attacked, find help fast! It can get messsy and it can be hard to know for how long the attack will continue. Expert help is essential.

Good luck out there.