Serious question about a DDOS attack!

[AceCanoe]

For the first time, I received a DDOS attack on one of my domains yesterday. I'm not sure how or why it happened but it did and my whole host went down for the whole day.

So I'm currently hosting with HostWinds, I was hosting with the ultimate Business host when the DDOS attack was happening. They suggested that I'd upgrade to a dedicated server which is around $110 per month and I did.

I'm not sure if it's worth it though. I did lose a lot of money from the down time yesterday which sucked and I'd want to avoid any down time but would you think spending $110/m would be worth it? Some other people said that was way too much for my small WordPress blog that doesn't even surpass 5,000 views per month.

Someone else said to take a look at CloudFlare. They have a DDOS prevention plan for $20 per month but I'm not sure what the difference is. I also have been hosting with HostWinds since 2013 and I'd feel uncomfortable switching to a new host that I'm unfamiliar with. I'm somewhat familiar using the "free plan" from CloudFlare which allows me to still use HostWinds as my host so hopefully the $20/m plan would work as the same?

What would you guys do if you were in my position? Also not to mention, It's not like I don't have the money to pay $110/m for a dedicated server - I do, but would you throw some of your money down the drain if you didn't have to?

I'd appreciate any help. I'm very new to this, 'ddos/vps' stuff so anybody who is experienced at all, I'd appreciate your recommendations or suggestions.

Thanks!

 

[davids355]

I was just going to suggest cloudflare as well.

How much traffic does your site get and how much income does it generate? They are probably the factors I’d be considering when deciding on hosting.

 

[AceCanoe]

I was just going to suggest cloudflare as well.

How much traffic does your site get and how much income does it generate? They are probably the factors I’d be considering when deciding on hosting.

The $20/m plan correct? The second plan is $200/m which is way more than the HostWinds dedicated server plan that I'm currently paying for which is $110/m. I paid $15 for it yesterday and the $110 recurring payment starts in 3-4 days so I have that much time to cancel it.

My WP site gets about 200-300 views per day and barely 5,000 views per month. It generates about $250 per day currently. I'm still quite indecisive on what I should do. Is cloudflare alright for you? $20 per month is quite cheap compared to the $110/m dedicated server at HostWinds.

 

[Diplomat]

Before you upgrade anything you should understand what they are attacking. If they are attacking your website directly or DNS then you should use Cloudflare, yes. Even their free plan should work fine for smaller attacks and if things get serious, you can upgrade to some paid plan.
If they are attacking something else then Cloudflare really doesn't help much.

Also, are you 100% sure it's actually DDOS? Maybe it's a dumbass crawler that got stuck or someone tries to log in to your WP?

 

[davids355]

You’d have to look at the differences between those cloudflare plans, I’m not an expert on them, it was just an initial thought.

If it’s fenerating that money though, I’d probably have it on a managed hosting plan if it was me.

Is the dedi from hostwinds managed?

 

[Sephrata]

So I'm currently hosting with HostWinds, I was hosting with the ultimate Business host when the DDOS attack was happening. They suggested that I'd upgrade to a dedicated server which is around $110 per month and I did

Hmm, I don't really understand this. Any host should have DDoS protection before it hits your server.

I don't follow what difference it makes if you're on shared, VPS or a dedicated server.

The $20/m plan correct? The second plan is $200/m which is way more than the HostWinds dedicated server plan that I'm currently paying for which is $110/m. I paid $15 for it yesterday and the $110 recurring payment starts in 3-4 days so I have that much time to cancel it.

Doesn't the free plan include DDoS protection?

 

[AceCanoe]

Before you upgrade anything you should understand what they are attacking. If they are attacking your website directly or DNS then you should use Cloudflare, yes. Even their free plan should work fine for smaller attacks and if things get serious, you can upgrade to some paid plan.
If they are attacking something else then Cloudflare really doesn't help much.

Also, are you 100% sure it's actually DDOS? Maybe it's a dumbass crawler that got stuck or someone tries to log in to your WP?

I'm not sure how I can see what they are attacking. Here's what one of the support staff members messaged me via the support ticket though:
"Hello X,
We see that the domain X.com is attracting DDoS which is causing high traffic and bandwidth usage. You can check this from your cpanel bandwidth usage.

Please note that the IP address X is null routed due to DDoS. Since we do not have control over the null route, you need to wait for another 24 hours to get it re-routed."

I have no experience with DDOS's but I believe it may be an attacker as it was causing high traffic and bandwidth usage that shut down my whole host/IP.

 

[AceCanoe]

You’d have to look at the differences between those cloudflare plans, I’m not an expert on them, it was just an initial thought.

If it’s fenerating that money though, I’d probably have it on a managed hosting plan if it was me.

Is the dedi from hostwinds managed?

Cloudflare doesn't really mention the 'differences'. I'm also not sure what you mean by managed? I'm still very new to dedicated servers or VPS.

 

[AceCanoe]

Hmm, I don't really understand this. Any host should have DDoS protection before it hits your server.

I don't follow what difference it makes if you're on shared, VPS or a dedicated server.

Doesn't the free plan include DDoS protection?

That's what my friends said. I guess it was a strong DDOS attack? I believe every host tries to guarantee uptime however if the attack is strong enough, the host will be forced to shut down my host and IP a long with all of the domains hosted there to prevent other server's from being affected I guess?

 

[Sephrata]

Some other people said that was way too much for my small WordPress blog that doesn't even surpass 5,000 views per month.

To go from shared hosting to a dedicated server for a site of this size is a crazy recommendation by your host, in my opinion.

That's what my friends said. I guess it was a strong DDOS attack? I believe every host tries to guarantee uptime however if the attack is strong enough, the host will be forced to shut down my host and IP a long with all of the domains hosted there to prevent other server's from being affected I guess?

If you were on shared hosting, then it is likely to have taken down the whole server.

I am just not convinced about the advice you've been given. It seems like HostWinds have tried to sell you something you don't need, especially since it shouldn't make a difference to a DDoS attack.

 

[Diplomat]

I'm not sure how I can see what they are attacking. Here's what one of the support staff members messaged me via the support ticket though:
"Hello X,
We see that the domain X.com is attracting DDoS which is causing high traffic and bandwidth usage. You can check this from your cpanel bandwidth usage.

Please note that the IP address X is null routed due to DDoS. Since we do not have control over the null route, you need to wait for another 24 hours to get it re-routed."

I have no experience with DDOS's but I believe it may be an attacker as it was causing high traffic and bandwidth usage that shut down my whole host/IP.

DomainX.com is attacking DDOS? Wat.. If there's a domain that's sending you traffic, then you can quite easily block it via htaccess (if you don't have access to something better).
Or if there's just 1 IP sending traffic then they can just block that IP (or you can do it via htaccess, if you don't have access to anything better) and that's that..

If you have access to SSH.. You could install mod_security, fail2ban or mod_evasive for example which would protect you from most stupid attacks.

But yeah..that explanation is kinda strange.

 

[AceCanoe]

To go from shared hosting to a dedicated server for a site of this size is a crazy recommendation by your host, in my opinion.

So what would you do? I'm afraid to switch back to the business host that I was hosting with previously if that was easy for the attacker to take down my whole host for the day. The dedicated sever seems safer but quite expensive for the size of my one domain as you said yourself. I need decent DDOS prevention though for a good price that fits my domain. Not sure where to find it.

 

[lorentzo]

You need to know the source of the ddos.

It is a DNS ddos type? Is it on udp maybe?

 

[AceCanoe]

DomainX.com is attacking DDOS? Wat.. If there's a domain that's sending you traffic, then you can quite easily block it via htaccess (if you don't have access to something better).
Or if there's just 1 IP sending traffic then they can just block that IP (or you can do it via htaccess, if you don't have access to anything better) and that's that..

If you have access to SSH.. You could install mod_security, fail2ban or mod_evasive for example which would protect you from most stupid attacks.

But yeah..that explanation is kinda strange.

I believe you read that wrong. One of my main domains on my host was "attracting" the DDOS. Somebody was attacking the one domain (which was on 1 IP that's connected to my whole host) so it took down my whole host. The IP was connected to my main domain and the rest of the domains so everything was offline.

 

[AceCanoe]

If you were on shared hosting, then it is likely to have taken down the whole server.

I am just not convinced about the advice you've been given. It seems like HostWinds have tried to sell you something you don't need, especially since it shouldn't make a difference to a DDoS attack.

It was on a business host, basically a better shared host I guess? Yes, it literally took down the whole server for the whole day. That's why I upgraded to the dedicated server that they suggested to prevent any future down time or DDOS.

They didn't force me to buy the dedicated server plan, I was afraid at the time and wanted my host and domains up again as I was losing a lot of money while my domains were offline and non-responsive. I believe I need some type of DDOS prevention. I believe shared hosts or business hosts are not built to take strong DDOS attacks so I need to do something.

 

[Sephrata]

I need decent DDOS prevention though for a good price that fits my domain. Not sure where to find it.

I believe that Cloudfare's free plan should meet your needs.

So what would you do?

I would seriously consider whether HostWinds is the right host for you. They have sold you something you don't need, and more importantly, not resolved the source of the DDoS attack.

You should scale up from shared to VPS and then dedicated based on resource usage, not because someone is trying to attack you.

I believe shared hosts or business hosts are not built to take strong DDOS attacks so I need to do something.

I believe this is incorrect. Remember a shared host will have multiple domains on the same server, so an attack against the server IP will affect other domains being hosted also.

 

[AceCanoe]

You need to know the source of the ddos.

It is a DNS ddos type? Is it on udp maybe?

I have no idea how to figure that out. I just know that my whole server was down due to a DDOS attack on one of my domains.

This is what one of the staff members from my host said via a support ticket:
"
Hello X,

We see that the domain mydomain.com is attracting DDoS which is causing high traffic and bandwidth usage. You can check this from your cpanel bandwidth usage.

Please note that the IP address "my IP address" is null routed due to DDoS. Since we do not have control over the null route, you need to wait for another 24 hours to get it re-routed."

That's all that was said. I could ask them what type it is if it's really important?

 

[BlogPro]

DomainX.com is attacking DDOS? Wat.. If there's a domain that's sending you traffic, then you can quite easily block it via htaccess (if you don't have access to something better).
Or if there's just 1 IP sending traffic then they can just block that IP (or you can do it via htaccess, if you don't have access to anything better) and that's that..

If you have access to SSH.. You could install mod_security, fail2ban or mod_evasive for example which would protect you from most stupid attacks.

But yeah..that explanation is kinda strange.

"Attracting" not "Attacking"

@AceCanoe - Get started on the Cloudflare Free Plan. It includes unmetered DDOS mitigation and you'll be set.

Once you start exploring the Cloudflare panel, you can check for other things and if you need them, apply them.

A regular DDOS is nothing much to worry about. Cancel that dedicated server.

If you want me to take a deeper look, let me know and I'll help you.

 

[AceCanoe]

I believe that Cloudfare's free plan should meet your needs.

I would seriously consider whether HostWinds is the right host for you. They have sold you something you don't need, and more importantly, not resolved the source of the DDoS attack.

You should scale up from shared to VPS and then dedicated based on resource usage, not because someone is trying to attack you.


I believe this is incorrect. Remember a shared host will have multiple domains on the same server, so an attack against the server IP will affect other domains being hosted also.

I don't know about the free plan, I'm afraid my host would have still been offline from the DDOS if I had that? I believe I have Cloudflare's free plan installed on 2 of my domains on my host that was attacked yesterday and all of the domains were down and offline.

I don't know how to work either the VPS or dedicated plan. They gave me the FTP details so I could work via FileZilla like I did with my business host though so that's the only section I'm familiar with including WP admin. Also, it was not a shared host. It was a business host. Only my domains were on the host/server and they all were affected/offline the whole day yesterday due to the DDOS attack.

 

[AceCanoe]

"Attracting" not "Attacking"

@AceCanoe - Get started on the Cloudflare Free Plan. It includes unmetered DDOS mitigation and you'll be set.

Once you start exploring the Cloudflare panel, you can check for other things and if you need them, apply them.

A regular DDOS is nothing much to worry about. Cancel that dedicated server.

If you want me to take a deeper look, let me know and I'll help you.

Could you read the post I just posted above if you have the time? I honestly took the attack quite seriously yesterday as my whole server/host including all of my domains were down/offline the whole day. This never happened before and I'm not sure the free Cloudflare plan would protect against that same attack. I'd appreciate it if you can help me!