A slow or unreachable website does not by itself prove a DDoS attack. The first business need is to understand the affected service and business impact while authorised providers handle technical diagnosis. This guide addresses business and communications readiness; it is not a set of technical intervention instructions for production systems.
Assign responsibilities before an interruption
Keep support contacts current for hosting, domains, connectivity and any protection service. Identify who opens an incident, the business decision owner and a backup. Rank important journeys such as sales, appointments and customer support. Contracts should explain protection scope, service hours and provider responsibilities; a product name does not imply unlimited protection.
Record symptoms separately from business impact
The first observation time, affected services and when the problem repeats help the provider investigate. Where practical, check ordinary user access from another connection without generating load tests. Describe affected ordering or enquiry journeys using service names and totals. Avoid unnecessary copies of customer messages, passwords or personal data.
Questions to ask the provider
- What has been verified, and which possible causes remain under investigation?
- Which services are affected, and could proposed changes affect other journeys?
- If a temporary workaround is proposed, what decision or approval does the business need to provide?
- When and through which channel will the next update be given?
Communicate what has actually been verified
Tell customers which service is affected, which approved alternatives are available and when to expect the next update. Do not announce an unverified attack type, data loss or guaranteed recovery time. An agreed communications channel can help keep people informed without depending on the affected service. Assess access and data-handling needs for alternatives in advance.
Record recovery checks and follow-up actions
Confirm the results of priority journeys as well as homepage availability. Assign an owner to review requests that accumulated during the interruption. Ask the provider for a verified incident summary, residual risks and proposed improvements. This record helps assess capacity or protection investment against business impact and service scope rather than assumptions.
