Ecommerce DDoS Protection Before Black Friday: A Four Week Plan

Ecommerce DDoS protection before Black Friday is two separate jobs: enough capacity for real customers, and filtering for floods aimed at the pages that cost most to serve. With four weeks to go, inventory and load test now, cache and rate limit in early November, then freeze and rehearse failover before the rush.

Black Friday 2026 falls on Friday 27 November and Cyber Monday on Monday 30 November. An hour offline costs most on those days, which is why they suit extortion and disruption attacks. They are also when a genuine rush is easiest to mistake for an attack.

Is it a DDoS attack or just Black Friday server load?

These are two problems with two fixes. Capacity is whether your stack can serve the customers who really turn up: CPU, PHP or application workers, database connections, memory, cache hit rate and the network port. Protection is whether junk traffic is filtered before it reaches the server, or absorbed by your stack when it looks ordinary.

Being slow under real load is not a DDoS, and a bigger protection tier will not speed up a slow checkout. A faster server does nothing against a volumetric flood, which has to be filtered upstream. Fix both, separately.

Ports are capacity too: our VPS ports are shaped at 100 to 300 Mbps by plan and dedicated servers get a guaranteed 1 Gbps unmetered port, so cache and compress product images early.

How to tell real customers from a flood

• Orders follow real traffic. Requests double and orders rise with them: a good day. Requests double and orders stay flat: look closer.
• Real visitors spread out across many product and category pages. Floods hammer a few URLs, often with random query strings to dodge the cache.
• Real browsers fetch everything: images, CSS and scripts, with session cookies. Many flood clients fetch only the HTML.
• Concentration: a few address ranges or one odd user agent sending a large share of requests.

On a standard access log, awk '{print $7}' access.log | sort | uniq -c | sort -rn | head lists the top URLs, and the same with $1 lists the top client addresses.

Which pages does a DDoS attack on an online shop target?

A Black Friday DDoS at Layer 7 does not need to be large. It needs to land on pages that cannot be cached and are expensive to build.

Page	Why it is expensive	First defence
Cart	Tied to a session, never cached, writes on every change	Rate limit per address, sessions in memory
Checkout	Totals, tax and shipping rates calculated on each request	Rate limit, cap concurrent connections per address
Search	A free text database query on every request	Cache popular results, minimum query length, rate limit
Filtered category pages	Every filter combination is a new URL and a cache miss	Cache normalised filter URLs, cap how many filters combine
Login	Password hashing is slow on purpose and burns CPU	Strict rate limit of its own
Coupon validation	A database lookup per attempt, and a target for code guessing	Rate limit, lock after repeated failures
Stock checks	Background requests from product pages, sometimes on a timer	Cache for a few seconds, rate limit

On every voxa.host tier except 10 Tbps + Layer 7, HTTP floods on these pages are handled in your own stack, so this table is your Layer 7 plan. More in our guide to Layer 7 DDoS protection against HTTP floods.

How to protect an online store from DDoS in the next four weeks

26 October to 1 November: inventory, load test, baseline, decide

1. Inventory every public hostname and IP address (admin, API, mail, staging, forgotten subdomains) and the server each one lands on.
2. Load test product, category, search, add to cart and checkout up to payment, on a staging copy the same size as production or on production at the quietest hour. Aim above last year's peak and tell your provider first.
3. Record a baseline of normal requests per second, top URLs, p95 response time, busy PHP workers and database connections on a busy evening. Anomalies only show against a known normal.
4. Decide the protection tier and whether the server is big enough. Our Xeon dedicated servers deliver in under an hour, EPYC is built to order, so if the load test asks for more cores, order this week.

2 to 15 November: cache, rate limit, separate, add a second location

1. Cache full pages for anonymous visitors and confirm the hit rate in the response headers.
2. Rate limit cart, checkout, search, login, coupon and stock endpoints, as shown below.
3. Separate management access. Put the admin URL behind an allowlist or a VPN and SSH on a second IPv4 address (extra addresses are a checkout option), so a null routed storefront address does not lock you out.
4. Origin IP hygiene. If a proxy or CDN sits in front, let the origin accept web traffic only from it. Send mail from another host and delete old DNS records that point at the origin.
5. Second location and low TTLs. Keep a warm standby with a current copy of the catalogue and lower DNS TTLs to a few minutes. See pairing two VPS locations for failover.

16 to 22 November: freeze, rehearse, publish contacts

1. Change freeze from Monday 16 November until Cyber Monday is over: no theme, plugin, extension or platform updates except security fixes.
2. Rehearse failover once, end to end, in a quiet hour, and write down how long each step took.
3. Off site status page on a different network and domain from the shop.
4. Incident contacts: who decides, who talks to customers, your hosting provider, your payment provider and whoever can change DNS.

23 to 30 November: watch, compare, follow the runbook

1. Watch order rate next to request rate, error rate, response time, worker and database saturation, plus checks from monitoring in another city.
2. Compare anything strange with the baseline first. A spike with orders rising is the day you planned for.
3. If it is an attack, follow the runbook in our guide on what to do during a DDoS attack.

What should WooCommerce, Magento or PrestaShop shops change?

On all three the pattern is the same: anonymous pages can be cached, anything tied to a session cannot.

• Full page cache for anonymous users, built in, through a module or behind a caching reverse proxy such as nginx. Key the bypass on the session or cart cookie, such as woocommerce_items_in_cart.
• Cart and checkout stay uncached but never open to unlimited requests.
• Search off the main database. Cache popular results for a few minutes, or move search to a dedicated service, so a flood cannot take the database with it.
• Sessions in memory. A store such as Redis keeps session reads off the database.
• Database sizing. Give the buffer pool enough RAM for the hot data, set the connection limit above your worker count and switch on the slow query log during the load test. See our guide to sizing database servers.
• PHP workers. Set pm.max_children from the memory one worker really uses under load. Too many workers on too little RAM means swapping, which is slower than queueing.

A starting point for nginx with WooCommerce style paths. Magento and PrestaShop differ only in the paths.

# example values, tune from your own logs
limit_req_zone $binary_remote_addr zone=shop:10m rate=5r/s;
limit_req_status 429;

location ~ ^/(cart|checkout|my-account) {
    limit_req zone=shop burst=20 nodelay;
    try_files $uri $uri/ /index.php?$args;
}

Mobile customers often share one address behind carrier NAT, so keep bursts generous and test the limits before Black Friday.

How much ecommerce DDoS protection does a shop need in November?

Every voxa.host VPS and dedicated server includes 100 Gbps of always on DDoS protection at Layer 3 and Layer 4, filtered upstream and active from delivery at no extra charge. The first 5 attacks a month above 100 Gbps are still mitigated free. From the 6th in the same month, the targeted IP address is null routed until the attack ends or the server is upgraded to a larger tier. Only that address goes dark (see our null routing explainer).

Tier	Layers	Per server, per month
100 Gbps	L3/L4	Included
500 Gbps	L3/L4	€156.45
1 Tbps	L3/L4	€523.95
2 Tbps	L3/L4	€1,048.95
5 Tbps	L3/L4	€2,623.95
10 Tbps + Layer 7	L3/L4/L7	€4,723.95

Prices exclude VAT and cover every IP address on the server. Tiers are billed monthly per server, chosen as an add on at checkout or changed later from the client area, with no per attack fee. Our guide to DDoS protection pricing models compares that with other ways of billing.

When the included tier is enough

A shop with no history of attacks, no threat in its inbox and the Layer 7 work above done in its own stack is well served by the included 100 Gbps.

When to take a larger tier for November and December

Consider 500 Gbps or 1 Tbps if you have been attacked before, if you have received a threat, or if an hour offline would cost more than a month of the tier. Black Friday to Cyber Monday is one four day weekend, so a determined attacker could use up all five over cap attacks inside it, and a sixth would null route the targeted address. See how much DDoS protection you need for the sizing. If you plan to change tier again after the season, ask us first.

When 10 Tbps + Layer 7 makes sense

It is the only tier with Layer 7 filtering. It fits a shop facing HTTP floods on checkout and search that its own rate limits and caching cannot hold, or with nobody on hand to tune nginx rules during the peak.

Worked example: tier price against an hour offline

Example figures, not a forecast: a shop expects €60,000 of orders from Black Friday to Cyber Monday, mostly across 40 busy hours, so about €1,500 an hour.

• 500 Gbps at €156.45 a month equals about 6 minutes of trading.
• 1 Tbps at €523.95 equals about 21 minutes, or 42 minutes for November and December together.
• 10 Tbps + Layer 7 at €4,723.95 equals a little over 3 hours.

Use margin instead of revenue for a stricter test, and weigh how likely an attack really is.

What should you do about a ransom DDoS threat before Black Friday?

A ransom DDoS email to an ecommerce shop is timed for the weeks that hurt most, sometimes with a short demonstration attack and a deadline.

1. Do not pay and do not negotiate. Payment buys no guarantee and marks you as a shop that pays.
2. Keep the evidence: the full email with headers, the payment address, timestamps, and logs or a tcpdump capture of any demonstration.
3. Report it to the police or your national cybercrime reporting point, and send the evidence to your hosting provider.
4. Harden as if the threat is real: bring the plan above forward, consider a larger tier for the threatened month and keep admin access off the storefront address.

Next step: protect the shop before the rush

The included 100 Gbps, the over cap rules and every tier are set out on our DDoS protection page. If your shop runs WooCommerce or a similar PHP stack, our web hosting and WordPress page covers the VPS side.