All About Cookies is an independent, advertising-supported website. Some of the offers that appear on this site are from third-party advertisers from which All About Cookies receives compensation. This compensation may impact how and where products appear on this site (including, for example, the order in which they appear).
All About Cookies does not include all financial or credit offers that might be available to consumers nor do we include all companies or all available products. Information is accurate as of the publishing date and has not been provided or endorsed by the advertiser.
The All About Cookies editorial team strives to provide accurate, in-depth information and reviews to help you, our reader, make online privacy decisions with confidence. Here's what you can expect from us:
- All About Cookies makes money when you click the links on our site to some of the products and offers that we mention. These partnerships do not influence our opinions or recommendations. Read more about how we make money.
- Partners are not able to review or request changes to our content except for compliance reasons.
- We aim to make sure everything on our site is up-to-date and accurate as of the publishing date, but we cannot guarantee we haven't missed something. It's your responsibility to double-check all information before making any decision. If you spot something that looks wrong, please let us know.
Distributed denial-of-service (DDoS) harasses and attacks users and organizations globally. A DDoS attack is very much like coming into a crowded room and everyone screaming, "John!" at the same time. Trying to figure out who said your name first is overwhelming. Your brain, like the servers targeted by a DDoS attack, can only process so much.
Hackers use this same method to overwhelm routers and firewalls with too many network connections. And just like you might feel after hearing your name called a thousand times in one second, the device receiving more connection requests than it’s built to handle quickly becomes overwhelmed and begins to shut down.
A DDoS attack can prevent any new connections from being processed, making the targeted website or network unavailable. But using a virtual private network (VPN) could help protect you against a DDoS attack by masking your IP address and encrypting your traffic. Here’s how.
What’s a DDoS attack?
How do you know if you’ve been DDoSed?
Does a VPN prevent DDoS attacks?
Stopping a DDoS attack is near impossible. Hackers often target known websites and public IP addresses. Most DDoS attacks are automated botnet scripts that often run on random schedules. Hackers will stop attacks and restart just to get around any preventive controls.
The hackers will also attempt to load malware on hosts so they can become a launch platform for future attacks. This is also known as a zombie host. (No relation to The Walking Dead series of A&E.)
If a hacker has no idea what your actual IP addresses are, they have no target for their DDoS attack scripts. Once a hacker does obtain your real IP address, there are limited options available to help stop the attack.
Fortunately, VPNs can help by encrypting your online traffic and hiding your real IP address behind the VPN server's IP address.
What’s the best VPN service for DDoS protection?
Several VPN providers offer excellent DDoS protection capabilities, including NordVPN, ExpressVPN, and CyberGhost. Many also provide global VPN coverage and other built-in security that could be beneficial in the event of a DDoS attack:
- Blocking bad traffic: Along with blocking a DDoS attack, this could help improve your internet speed and reduce lag.
- Always-on protection: Meaning you don’t need to manually turn on your VPN protection. Instead, it’s activated any time an attack is detected.
- Kill switch: This feature cuts your internet connection if your connection to the VPN server drops or gets disabled. This ensures you won’t accidentally browse the web while your data is unencrypted and your IP address is revealed.
Best DDoS protection VPNs
|VPN||Monthly plan||Annual plan|
|NordVPN||$11.99/mo||$3.99/mo (for 24 mos)|
|ExpressVPN||$12.95/mo||$8.32/mo (for 24 mos)|
|CyberGhost||$12.99/mo||$3.29/mo (for 24 mos)|
|Surfshark||$12.95/mo||$2.49/mo (for 24 mos)|
|PureVPN||$10.95/mo||$1.99/mo (for 27 mos)|
What’s a DDoS attack?
A DDoS, or distributed denial-of-service, attack is a type of cyberattack used by hackers to force people offline. It involves multiple computers sending requests to a server at an overwhelming rate.
Cybercriminals use botnets to launch DDoS attacks. Botnets are usually composed of hundreds or thousands of computers or zombie hosts whose owners are not aware they are being used as an attack platform.
Businesses, especially smaller ones, are increasingly at risk from cyberattacks. According to Accenture’s Cost of Cybercrime Study, 43% of cyber attacks target small businesses, but only 14% have the means to respond to a DDoS attack.
Are DDoS and DoS the same thing?
Denial-of-service (DoS) attacks are different from DDoS attacks in several ways. DoS attacks originate from a single attacking source. DDoS attacks tend to launch from several distributed sources.
DoS attacks fall into two major categories:
- Application attacks: Attacks against applications being hosted on a targeted platform.
- Network attacks: These attempt to overwhelm the network by sending several connections for the device to process. Ultimately, if the device reaches its connection processing limit, the system will be unavailable and network traffic will stop.
|Type of attack||DDoS||DoS|
|Does it use malware?||Yes||Yes|
|How it works||A botnet or multiple hosts infected with malware.||A script executed on a single device to attack a specific IP address or DNS name.|
|How easy is it to trace?||Difficult. DDoS attacks are distributed across many unrelated networks and hosts globally.||Easy. DoS attacks come from a single source IP address that can be blocked by your router or firewall.|
Both DoS and DDoS attacks may use malware. Often DDoS will start with a phishing email containing a malware payload. This malware will turn the unsuspecting host into a zombie. The host becomes part of the attack vector along with other zombie hosts.
DoS attacks will normally use malware to set up and disrupt the victim's network. After the malware is installed, the hacker will launch a script from a single source against an IP address attempting to overwhelm the TCP stack with too many connections to process.
DDoS attacks are far more complex and difficult to stop because the attack hosts are distributed globally. Many DDoS hacker groups will throttle their attacks to avoid detection.
But DoS attacks can still cause serious problems for any single website or a range of IP addresses. Compared to DDoS, a DoS attack can be stopped once the source attack IP has been discovered.
How do you know if you’ve been DDoSed?
There are several ways to determine whether you are under a DDoS attack, including
- Your website is down and visitors see an HTTP 503 error code
- Your connection speeds drop dramatically
- You’re unable to login into a banking or other financial system
- Your Wi-Fi connection drops out
Hackers tend to launch attacks during the busiest times of the day for maximum impact. If you realize you’re being DDoSed, you could try restarting your router to see whether you receive a new dynamic IP address the hacker isn’t targeting.
How to prevent future DDoS attacks
Here are some recommendations to help avoid a future DDoS attack
- Ensure the service provider you subscribe to issues a dynamic IP address, not static. With dynamic addresses, they will change every day. The hackers will have difficulty discovering your IP address if it changes frequently.
- Make sure that all your home devices are protected from viruses and malware.
- Enable a VPN connection on your device to protect your data and IP address.
- Use a Wi-Fi router to protect your internal network from a DDoS attack. Most routers have several security features to help protect your home network. You should also update your Wi-Fi network name and password.
- Use anti-DDoS software or apps, like Indusface AppTrana or SolarWinds Security Event Manager. (Heads up: These apps may be a pricier solution since they're geared toward businesses.)
Gamers can use a VPN to help encrypt internet traffic and protect their online identity. A VPN can help stop DDoS attacks by hiding your known IP address within a global or online gaming network.
Several VPN vendors support safe gaming:
Does NordVPN protect against DDoS attacks?
Yes, NordVPN can help protect against DDoS attacks by masking your IP address, making it more difficult for a hacker to target you.
Can a firewall stop a DDoS attack?
Yes and no. A firewall can help stop a DDoS attack if the source IP addresses of the attackers are discovered. However, DDoS attacks could be coming from several thousand attackers. Instead, using a VPN is likely a better way to prevent a DDoS attack.
Does restarting your router stop a DDoS attack?
Yes, restarting your router should stop a DDoS attack if your device receives a new dynamic IP address from the ISP. If your router receives the legacy IP address, however, the DDoS attack might continue even after a restart.
Although there is no 100% prevention against a DDoS attack, a VPN does provide capabilities, including IP address masking and encryption, to help provide critical layers of protection.
About 43% of people use a VPN for security reasons, according to an anonymous survey from Surfshark, a popular VPN provider. It makes sense because VPNs help reduce your exposure to DDoS attacks by hiding your IP address. If a hacker doesn’t know your IP address, that reduces the ability for them to launch an attack against you.
Protection against hackers is just one benefit of using a VPN, which can make it well worth the investment.