The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →First, identify what the traffic is doing before treating it as a breach. An automated spike may be a denial-of-service attempt, repeated login abuse, exploitation of a vulnerable component, a legitimate surge in visitors, or a configuration problem. Check the evidence, contact your hosting provider early, and choose controls that match the risk; unusual traffic alone does not prove that your site was attacked or hacked.
What kind of incident are you seeing?
Separate the symptoms before deciding what to change. A denial-of-service (DoS) attempt aims to overload a website or network and reduce availability. A distributed denial-of-service (DDoS) attempt comes from multiple sources, which can make malicious traffic harder to distinguish from legitimate visitors. Repeated automated login requests may indicate account abuse, while automated exploitation targets a vulnerability in software the site uses. A confirmed hack means there is evidence of unauthorized access or malicious changes—not merely a traffic spike.
As an Amazon Associate I earn from qualifying purchases.
These cases can overlap, but the first response differs: availability pressure calls for traffic and capacity controls; login abuse calls for protections on authentication routes; suspected exploitation calls for checking the affected software and possible compromise; a hacked site needs containment and recovery. The UK National Cyber Security Centre (NCSC) explains DoS risks and preparation in its Denial of Service guidance, reviewed 25 March 2024.
How to assess an unusual traffic spike
Compare what is happening now with the site’s normal baseline and known events, such as a promotion or a page receiving unusual attention. High legitimate interest and internal misconfiguration can also cause load; unusual activity is not proof of an attack. The NCSC recommends looking across the service rather than relying on one metric.
#1 Best Overall
- Fortinet Web Application Firewall - virtual appliance for all supported platforms. Supports up to 2 x vCPU core
- Fortinet HW FWB-VM02
- Manufacturer Part: FWB-VM02
- Requests and bandwidth: Check request volume, traffic sources and bandwidth against typical levels.
- System pressure: Review server or processor load and database activity. A request surge may not be the only reason a component is struggling.
- Service health: Check availability, errors, response problems and alerts across relevant systems.
- Security signals: Look for repeated requests to login routes, activity tied to a vulnerable component, or other indicators in host and security logs.
- Timeline: Preserve useful logs and timestamps while investigating so you and your provider can compare events.
The NCSC’s DoS response guidance recommends comparing activity across system components and considering alternative causes before responding.
Contact your host or provider early
Ask your hosting provider what it can see, whether upstream systems or other customers are affected, what traffic mitigations are available, and whether it has evidence of compromise. Share useful indicators and timestamps, and follow its incident escalation process. If the problem is a large traffic flood, controls at the provider or upstream may be more effective than blocking individual requests in the application.
If there may have been a hack, ask the host for its account of the incident and what it has done to identify or remove malicious content. Cloudflare’s hacked-site recovery guidance, last updated 20 April 2026, also recommends working with the host on recovery.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- Fortinet Web Application Firewall - virtual appliance for all supported platforms. Supports up to 4 x vCPU core
- Fortinet HW FWB-VM04
- Manufacturer Part: FWB-VM04
Choose controls that fit the evidence
For likely denial-of-service traffic
Work with the host or security provider on proportionate measures. Depending on the architecture and traffic pattern, options include distributing traffic through a CDN, filtering with a web application firewall (WAF), adjusting rate limits, setting allow or deny rules, load balancing, scaling, failover, or provider and firewall controls. The NCSC also suggests temporarily reducing costly application features—for example, disabling an expensive search feature.
Monitor service health and legitimate-user impact as you tune controls. A threshold or filter that is too broad can block real visitors or disrupt other services. Restore temporary restrictions carefully once evidence indicates the attack has eased and mitigations are in place.
For repeated automated login attempts
Review events on the login route and look for repeated or unusual bot activity. Cloudflare identifies a spike in low bot-score traffic on a login endpoint as a possible early signal of credential stuffing, in its bot-score documentation. This is a vendor-specific indicator, not proof of account takeover by itself.
Rank #3
- Fortinet Web Application Firewall - virtual appliance for all supported platforms. Supports up to 8 x vCPU core
- Fortinet HW FWB-VM08
- Manufacturer Part: FWB-VM08
Consider route-specific rate limits or access controls, coordinating with your host or security provider where appropriate. Check whether the changes block legitimate visitors or services such as monitoring and payment integrations. Cloudflare’s account-takeover guidance describes the threat; its feature availability and plan eligibility can change.
Recommended Free Tools
When comparing defensive options
A host control, CDN, WAF or specialist service is not automatically right for every site. Compare the options on these points:
- Which attack layer and traffic pattern the control addresses, and whether it acts upstream or in the application.
- How easily it can be tuned and what it may do to legitimate users.
- What logs and alerts it provides for investigation.
- What escalation and incident-response support is available.
- Whether it fits the site’s architecture and budget.
Respond to suspected exploitation as a security incident
If a software vendor reports active exploitation of a component your site uses, read the vendor’s advisory and any instructions for checking compromise. Establish which systems and versions are exposed. If appropriate, restrict or isolate the affected component while considering the business impact; coordinate with your host or administrator rather than making unsafe changes under pressure.
Rank #4
- Meraki MX100: A building block for SASE in a rack-mountable form factor. Medium- to large-branch security and SD-WAN appliance for up to 500 users.
- WAN: 1 x GbE RJ45, 1 x USB (cellular failover), Dual-purpose: 1 x GbE RJ45 +++ LAN: 8 x GbE RJ45, 2 x GbE SFP
- Stateful firewall throughput: 750 Mbps +++ 500 Mbps site-to-site VPN throughput
- Unified management for security, SD-WAN, Wi-Fi, switching, MDM, and IoT +++ Centralized management via web-based dashboard or API
- True zero-touch provisioning +++ Smartphone-like firmware updates
Investigate relevant logs and outbound connections for signs of compromise. Then apply the recommended updates and hardening, and continue checking for signs of malicious activity. For a confirmed or complex compromise, involve a qualified incident-response professional. The NCSC’s guidance on responding to active exploitation (version 2.1, published and reviewed 1 May 2026) emphasizes acting quickly when automated exploitation is underway.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Recover, verify and review
When evidence indicates the attack has reduced and mitigations are in place, remove temporary restrictions carefully and verify that the site behaves normally. Address any vulnerability that may have been exploited, and review what should change in detection, escalation and recovery.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesIf the site was hacked, work with the host on cleanup and check for applicable search-engine warnings. After resolving them, request a review through the relevant service. For an availability incident without evidence of compromise, do not treat the traffic itself as proof that content or accounts were altered.
Best Value
- ◆Powerful Celeron N2840 Processor: N2840 Processor, 2 Cores 2 Threads, 1M Cache, Max Turbo Frequency 2.58 GHz, TDP 7.5 W. Whether you need a robust home server, a versatile tool for school education, seamless web browsing, or even efficient business office or industrial tasks, providing efficient performance for everyday tasks.
- ◆Dual 1000M LAN: Mini Router PC with 2*Realtek RTL8111H network card chip full UDE 1000M with filter connector.Soft Router can monitor network data, improve network security, powerful and widely used.
- ◆DDR3L Memory & Large Storage Capacity: Firewall box computer with 1 x DDR3L SO-DIMM memory 1333/1600MHz, 1xMSATA3.0 SSD.
- ◆UHD Graphics & 4K Dual Screen Display: N2840 processor integrated UHD Graphics, HD and VGA dual display interfaces support 4K@60Hz.
- ◆Versatile Connections ports: 2 x1000M Realtek RTL8111H-LAN,2 xUSB3.0, 4 xUSB2.0, HDMI,VGA,AUDIO supports data storage and system boot.Mini desktop computer with WIFI dual antenna, which providing high-speed transmission and reliable connectivity. Support Dual Band Wifi, Internet, streaming media and audio can be used perfectly without interrupting the connection. Enjoy faster file transfers and smoother online experiences.
Prepare before the next incident
The NCSC’s DoS guidance frames preparation around understanding the service and its defenses, creating a response plan, and testing it. Practical preparation for a site owner includes:
- Know the host’s emergency contact and which traffic controls it can apply.
- Keep an inventory of the CMS, plugins and internet-facing services, and promptly update supported components.
- Protect administrator routes with suitably configured rate limits or access controls.
- Maintain backups of valid content and know how to restore them.
- Agree who can authorize restrictive filters, failover or a temporary outage.
- Test the response and retain access to relevant logs and alerts.
For UK readers, the NCSC materials are organizational guidance; reporting routes and obligations can depend on the organization and incident. Hosting and security-provider capabilities also vary, so confirm available controls and escalation arrangements with your own providers.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
