DDoS Attacks Are Changing: What Business Owners Should Do Now

Cloudflare’s latest DDoS report points to a change in the shape of attacks, not an end to the threat. In the third quarter of 2026, short attacks increased sharply, while attacks exceeding one terabit per second became less common. The report also describes a shift in the network protocols attackers used.

For a business owner, the practical message is that a website or online service does not need to face a huge, long-lasting attack to become difficult to use. A brief disruption can still get in the way of customer enquiries, purchases or staff work. Preparation should account for both smaller bursts and larger attacks.

Cloudflare says it mitigated 18.2 million network-layer DDoS attacks in the quarter, alongside 14.4 trillion HTTP DDoS requests. You can read the full Cloudflare DDoS Threat Report for Q3 2026 for its findings and methodology.

What changed in the latest report

The report covers July, August and September 2026. Cloudflare recorded a 208% increase in short-burst, low-bandwidth attacks lasting under 10 minutes and below 1 Gbps. It says 98% of network-layer attacks stayed under 1 Gbps, but notes that this can still be enough to overwhelm a server or website.

At the other end of the scale, attacks exceeding 1 Tbps fell to 251 in Q3, down from 805 in Q2. Cloudflare says this coincided with early-2026 law enforcement actions that dismantled four major IoT botnets: Aisuru, KimWolf, JackSkid and Mossad. The report also warns that new variants continue to emerge, so the decline does not mean IoT botnets have stopped being a threat.

Attackers also changed their use of reflection and amplification tactics. CLDAP attacks fell by 99.5% quarter over quarter, after a sharp rise earlier in the year. DNS amplification increased by 215%, while other UDP floods grew from 14.06% to 31.31% of network-layer attacks.

The mix of targeted industries shifted too. Media, Production & Publishing remained the most-attacked industry, but its share was roughly a quarter of its Q2 level. Internet, Consumer Services and Adult Entertainment appeared higher in the rankings. The United States was the most-attacked location, while Canada and Israel moved up the rankings.

These are observations from Cloudflare’s network. They are not a forecast of which business, country or industry will be targeted next.

Why smaller attacks still matter to a business

It is easy to focus on the biggest attack figures. But a business may feel the effect of a short disruption even if it never experiences an attack close to the report’s largest volumes. If visitors cannot reach a site or an online service becomes unavailable, customers may have difficulty doing what they came to do.

That could mean a shopper cannot complete an order, a prospective client cannot send an enquiry, or staff cannot access a business tool. These are possible business impacts, not claims that every attack will cause those outcomes. The right question is whether your essential online tasks have a fallback when a service becomes slow or unavailable.

The shift toward UDP floods and DNS amplification is also a reminder that attacks can change form. A plan built around one type of attack may not address every situation. Ask the people who manage your hosting, website or network what protections are in place and how they handle different kinds of traffic disruption.

Cloudflare’s report describes attacks across a broad range of industries and locations. That does not establish that every business faces the same level of risk. It does support treating availability as a business issue, rather than assuming DDoS attacks concern only the largest organisations.

Check where your business depends on being online

Start with the services your customers and staff rely on. For each one, identify who provides it, who manages its protection, and who you would contact if it became unavailable. If a supplier or technical partner manages the service, ask them to explain the arrangements in plain language.

Review your website’s role in daily business. Does it mainly provide information, or does it also take payments, collect enquiries, or support customer accounts? The more important a service is to your operations, the more useful it is to know how it is protected and what your team should do during an interruption. If your site needs a clearer structure or a more suitable technical setup, explore website development options.

Ask your provider specific questions, such as:

• What DDoS protection applies to my website or online service?
• Who monitors availability and handles an incident?
• How will you tell me if service is disrupted?
• What should my staff tell customers while we investigate?
• Which parts of the service could still work if another part is unavailable?

Do not assume protection is included just because your website is hosted somewhere. Ask your provider to explain what is covered, who is responsible, and whether you need to take any action. Record the answers where the people responsible for your website can find them.

Make disruption easier to manage

Technical protection matters, but a simple response plan helps your team act calmly. Choose who is responsible for checking the service, contacting your provider and updating customers. Make sure more than one person knows where to find the relevant contact details.

Decide in advance how your team will communicate if the website or a customer-facing service is unavailable. Keep the message factual: say what customers cannot do, what alternative contact method is available, and that you will update them when you have more information. Avoid guessing at the cause or promising a restoration time your provider has not confirmed.

Review the customer journey for points where an outage could create confusion. If customers normally place orders or send enquiries through your site, consider what information they need if that route is temporarily unavailable. Keep the alternative process straightforward and make sure staff know how to handle incoming requests.

For an online store, check that staff know how to respond if a customer reports trouble placing an order. For a service business, make sure customers can find an alternative way to contact you. If your website supports your sales process, a business website built around enquiries can help make important next steps clear. The design should reflect your operations, not create a substitute for technical DDoS protection.

Review these arrangements when your website, provider or business processes change. If you publish updates or rely on website content to answer customer questions, a blog and publication setup can support clear communication, but remember to plan how your team would share an update during an outage.

What to do next

1. List your essential online services, including your website, store and any tools customers or staff need to use.
2. Contact each provider and ask what DDoS protection is in place, who responds to incidents, and how you will receive updates.
3. Choose a staff contact to coordinate your response and make sure another person can step in.
4. Write a short customer message and identify an alternative contact route for periods when a service is unavailable.
5. Review the plan whenever you change providers or add an important online service.

Cloudflare’s Q3 findings show that DDoS activity can shift in size, duration, protocol and target. A business cannot control those changes, but it can understand its dependencies, ask clear questions of its providers and prepare its team to respond.