Mar 17, 2026 · Written by: Netspare Team

A Practical DDoS Readiness Checklist for SMEs

DDoS attacks range from volumetric UDP floods to crafty HTTPS GET storms that exhaust CPU on L7 proxies. SMEs cannot afford always-on terabit scrubbing like hyperscalers, but they can still reduce mean time to recovery with baselines, runbooks, and tested provider features.

Your CDN or ISP scrubbing center is only as good as the contacts and BGP/GRE tunnel details documented before the event. Panic-driven DNS changes propagate slowly and often break email.

Use this article as a living checklist: assign owners, dates, and evidence links in your internal wiki.

Application-layer attacks mimic legitimate traffic with rotating residential IPs—rate limits alone fail without behavioral scoring. Combine request fingerprinting with slow client detection at the proxy.

Insurance and cyber policies increasingly ask for evidence of annual drills; keep dated reports with redacted traffic graphs.

Traffic baselines and anomaly detection

Know normal RPS, unique client counts, and geographic distribution per public hostname. Spikes that preserve user-agent diversity but spike single URLs often indicate L7 attacks.

Alert on sustained deviation from baseline, not one-minute blips, to avoid alert fatigue.

Edge rate limits, WAF, and bot management

Start with conservative rate limits on login, cart, and search endpoints—cheap for attackers to abuse. WAF managed rule sets catch known signatures; custom rules block obvious scraper patterns.

Challenge modes (JS/captcha) harm UX; use only after softer throttles fail and communicate status pages to customers.

Origin shielding and IP allow-lists

Never expose origin IPs in DNS if you front with CDN; firewall allow-list only CDN pops.
Separate management VPN IPs from public website paths.
Keep a cold standby static status site on a different provider for comms-only traffic.
Document how to drain attack traffic to sinkhole vs. legitimate failover regions.

Customer and internal communications

Prepare status templates in three lengths (tweet, email, detailed post) and pre-approve who publishes. Legal/compliance may need wording for regulated sectors.

Internal Slack/email templates reduce duplicate questions to the on-call engineer during mitigation.

Quarterly drills and evidence retention

Run tabletop exercises with synthetic load against staging mirrored rules. Store PCAP or flow summaries (where lawful) to tune thresholds after the drill.

Post-incident, capture timelines with UTC timestamps, actions taken, and customer impact minutes for insurance or SLA discussions.

Layer 7 behavioral signals

Track request entropy: sudden uniformity in user-agent strings or path depth often marks bot swarms.

Challenge expensive endpoints (search, export) before homepage static assets to preserve cache efficiency.

Evidence for legal and insurers

Store summarized flow metadata where retention policies allow; full PCAP may be prohibited—agree formats with counsel upfront.

Chain of custody for logs matters if litigation follows a sustained attack.

Frequently asked questions

Will a bigger VPS stop DDoS?

Rarely for volumetric attacks; bandwidth is exhausted before CPU. You need upstream filtering or CDN absorption.

Is geo-blocking enough?

Rarely; attackers distribute globally. Use geo as a coarse filter only with override paths for legitimate VPN users.

Netspare Team