Cloudflare’s first-half 2026 report shows that short, small-looking attacks are widespread alongside very large ones. For a small business, even a few minutes of access problems can cost sales, reputation and operations.
First separate the attack surface
DNS service, CDN, web application, API and origin server are not the same layer. Each layer needs its own rate limit, caching, access and monitoring decision. If the origin address is directly visible, protection in front of the CDN means less.
Application-layer attacks
Not every high traffic is DDoS. An expensive search endpoint called hundreds of times per second can create serious cost or database load with little bandwidth. Rate limits, query cost and authentication are considered together for this reason.
First preparation list
- Make DNS and origin topology visible.
- Measure normal traffic behaviour.
- Put rate limits on API and login flows.
- Decide who decides during an incident.
- Prepare temporary throttling and maintenance communication in advance.
Source / further readingCloudflare — DDoS Threat Report H1 2026This article does not copy the original content of the source; it is WYN’s practical interpretation. For current headlines, check the publication date and the source page separately.