Why small sites get attacked at all
The most common misconception about website security is "why would anyone bother attacking me — I’m tiny." It is a natural thought and a dangerous one, because it imagines attacks as personal and deliberate. They are almost never either. The overwhelming majority of attacks on small business websites are carried out by automated software that scans the entire internet endlessly, trying known break-in techniques against every site it finds, with no idea and no interest in what your business is. To that software you are not a florist or an accountant; you are an address that either has a hole in it or does not.
A small site is actually an attractive prize for automated attackers precisely because small sites tend to be less defended. A compromised small business site is useful in dozens of ways that have nothing to do with your business: it can be used to send spam, to host scam pages, to attack other sites, to mine cryptocurrency, or simply to display injected spam links. The attacker does not need your site to be important. They need it to be reachable and unguarded. That is why protection that filters out this automated noise before it ever reaches you is valuable for the smallest site, not just the largest.
What a web application firewall does
A web application firewall sits in front of your website and inspects every request coming in, deciding whether each one looks legitimate or malicious before it is allowed to reach your actual site. Think of it as a doorman who checks everyone at the entrance rather than waiting to see what they do once inside. It recognises the signatures of common attacks — attempts to break into your login by trying thousands of passwords, attempts to exploit known software vulnerabilities, attempts to inject malicious code through a form — and it blocks those requests at the door, so they never touch your site at all.
This matters because so many attacks rely on reaching your site to probe it. A WAF neutralises whole categories of attack generically, including, crucially, attacks against vulnerabilities you have not patched yet. If a serious flaw is discovered in a plugin you use, there is a dangerous window between the flaw becoming public and you applying the update. A good WAF often blocks attempts to exploit that flaw during the gap, buying you time. It also throttles the relentless brute-force login attempts that hammer every site, and filters out bad bots. It is the closest thing website security has to a broad, always-on shield.
What DDoS protection does
A DDoS attack — distributed denial of service — is a fundamentally different threat. Instead of trying to break in, it tries to knock you offline by overwhelming your site with a flood of traffic from thousands of machines at once, far more than your server can handle, until legitimate visitors cannot get through. It is the digital equivalent of a mob jamming a shop doorway so real customers cannot enter. The attacker gains nothing from your data; the goal is simply to take you down, whether for extortion, sabotage, or spite.
DDoS protection works by putting an enormous, distributed network between the attacker and your site — one with far more capacity than any attack can muster — which absorbs and filters the flood, letting genuine visitors through while dropping the junk. A small business almost certainly cannot withstand a serious flood on its own hosting; the server would simply fall over. But routed through a large protective network, even a substantial attack is absorbed upstream and your site stays up. This used to be exotic, expensive infrastructure. It is now bundled into services a small business can turn on in an afternoon.
Where this protection lives
There are three common places to get a WAF and DDoS protection, and they are not mutually exclusive. The first is a plugin-level firewall that runs inside your website software — a WordPress security plugin, for instance. This is easy to install and genuinely helpful, but it has a limitation: because it runs inside your site, the malicious traffic has already reached your server before the plugin filters it, so it does little against a flood designed to overwhelm the server itself.
The second, and generally the strongest for a small business, is a cloud-based service in front of your site — you route your traffic through a large external network that filters everything before it ever reaches your host. Because the filtering happens upstream, it stops both application attacks and floods, and it is what actually protects against DDoS. The third is protection built into managed hosting, where your host runs the firewall and DDoS mitigation at the server or network level as part of the plan. The layered ideal combines the upstream cloud filter with sensible in-site hardening, so an attack is stopped far away and anything that slips through meets a well-defended site.
The free option most small sites should use
Here is the practical reality that surprises people: a very capable version of all this is free. Large content-delivery and security networks offer free tiers that route your site through their global network, giving you a baseline web application firewall, DDoS absorption, and bot filtering at no cost, with paid tiers if you need more. For the vast majority of small business websites, turning this on is the highest-value security step available for the money, because the money is nothing. It also tends to make your site faster at the same time, since these networks cache your content close to your visitors.
Setup is a matter of pointing your domain through the service, which for most people is a guided process or something a host or developer does in a few minutes. If your site is not behind any kind of upstream protection today, this is the thing to fix first — before buying any security plugin, before worrying about anything more exotic. It is the single change that takes you from wide-open to sensibly defended, and it costs less than the coffee you will drink while setting it up.
What a WAF does not do
Be clear about the limits, because a firewall creates a false sense of total safety if you misunderstand it. A WAF filters malicious traffic; it does not fix an already-infected site, and it does not excuse you from keeping your software updated. If an attacker already has valid login details, or if malware is already sitting in your files, the firewall at the front door does nothing about the problem already inside. It reduces how often you are attacked successfully; it does not make you invincible.
Security is layers, and a WAF is one important layer, not the whole wall. It sits alongside prompt updates, strong passwords and two-factor authentication, good backups, and regular malware scanning. Skip those and lean on the firewall alone and you will eventually be compromised through the gaps it was never meant to cover. Think of the WAF as dramatically thinning the flood of attacks that reach you, so your other defences face far less pressure — not as a reason to neglect them.
What I recommend
For a typical Canadian small business, the sensible setup is straightforward. Put your site behind a reputable cloud-based network with a WAF and DDoS protection — the free tier is genuinely enough for most — so the bulk of automated attacks and any flood are filtered upstream. Keep a lightweight security plugin or your host’s built-in protection as the in-site layer. And do not treat any of it as a substitute for the basics: updates, strong authentication, backups, and scanning are still what keep you safe day to day.
If configuring all this yourself feels like more than you want to take on, it is exactly the kind of thing a managed host sets up and runs for you — the upstream firewall, the DDoS protection, the monitoring — so it is handled without you having to become a security administrator. That is part of what I provide with managed hosting at Design Menu. However you get there, the goal is simple and very achievable: make your site one of the many that automated attacks bounce off, rather than one of the few they get into.