How to Protect a Website from DDoS Attacks — India 2026
A DDoS attack floods your website with junk traffic until real customers cannot get through — and Indian sites get hit hardest during festive sales and result days. You cannot stop attackers from launching an attack, but you can make your site absorb one without going down. This is the layered playbook we use for Indian businesses, from quick wins to carrier-grade scrubbing.
Steps
Step 1 — Put your site behind a CDN: A CDN (content delivery network) hides your origin server's real IP behind a global edge network and absorbs a lot of junk traffic before it reaches you. This alone stops a large share of amateur attacks. Ensure your origin IP is never exposed in DNS records, email headers or old subdomains — attackers hunt for it to bypass the CDN.
Step 2 — Add a Web Application Firewall (WAF): A WAF filters malicious Layer 7 (application) requests — HTTP floods, bad bots, injection attempts. A managed WAF such as Indusface AppTrana (Indian SOC tunes the rules) or Cloudflare gives you this without an in-house security team. Turn on bot management and rate-based rules.
Step 3 — Enable rate limiting and challenge pages: Cap how many requests a single IP or session can make per second, and serve a JS/CAPTCHA challenge to suspicious clients. This blunts Layer 7 floods that mimic real browsers. Tune thresholds to your genuine peak traffic so you don't block real festive-sale customers.
Step 4 — Add carrier-grade network scrubbing for volumetric floods: CDNs and WAFs cannot always absorb the largest volumetric (Layer 3/4) floods that saturate your internet pipe. For whole-pipe protection, add carrier scrubbing such as Tata Communications DDoS Protection Service — network-agnostic, so it protects your site even if your internet is from another ISP. Choose always-on for revenue-critical sites, on-demand for lower-risk ones.
Step 5 — Harden the origin and infrastructure: Restrict origin access to CDN/scrubbing IP ranges only, disable unused ports/services, use SYN cookies, and ensure your hosting/load balancer can auto-scale. Keep DNS on a resilient provider with anycast. Set generous but sane connection timeouts so slowloris-style attacks cannot hold sockets open.
Step 6 — Write and rehearse an attack-day runbook: Document who declares an incident, how to switch on-demand scrubbing, escalation numbers (your provider SOC / partner), and customer-comms templates. Run one drill before your peak season (e.g., before Diwali). A rehearsed runbook is the difference between 5 minutes and 5 hours of downtime.
Step 7 — Monitor, alert and review after every incident: Set alerts on traffic anomalies, error rates and origin CPU. After any attack, review what was hit, what worked, and what to tune. Providers with AI/ML analytics (Tata's SOC processes ~20M netflow records/min) give you post-attack reports to feed this review.
Frequently Asked Questions
Can I stop a DDoS attack for free?
Partly. A free CDN tier and basic WAF stop many small attacks, and good origin hardening costs nothing but time. But sustained or large volumetric floods (multi-Gbps) overwhelm free tiers — India-first budget services start around ₹999/month, and carrier-grade scrubbing is needed for the biggest attacks. Free is a starting layer, not a guarantee.
How do I protect my website during a Diwali or big-sale spike?
Before the sale: enable always-on scrubbing (or pre-arrange on-demand activation), raise CDN caching, tune rate limits to your expected genuine peak so real buyers aren't challenged, and rehearse the runbook. Festive peaks are the highest-risk DDoS window for Indian e-commerce, so treat scrubbing as part of sale-readiness, not an afterthought.
My hosting says it has DDoS protection — is that enough?
Often only for smaller attacks. Basic hosting protection typically handles modest volumetric floods but not large multi-Gbps or sophisticated Layer 7 attacks. For a revenue-critical Indian site, layer a WAF plus carrier or cloud scrubbing on top. We can assess your current coverage and fill the gaps.
National IT Service is an authorised Tata Communications partner — we supply the DDoS Protection Service with INR billing and a GST invoice. WhatsApp +91 98119 98370 for a scoped quote.