---
name: cis-ts-ddos
title: What do I do if I’m under a DDoS attack?
description: Your site is under DDoS attack.
last-updated: 2025-01-24
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/cis?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# What do I do if I’m under a DDoS attack?
{: #troubleshooting-cis-ddos-attack}
{: troubleshoot}
{: help}
{: support}

Your site is under DDoS attack.
{: tsCauses}

To help resolve a DDoS attack, take the following steps:
{: tsResolve}

1. Turn on "Defense Mode" from your dashboard.
2. Set your DNS records for maximum security.
3. Do not rate-limit or throttle requests from CIS.

During "Defense Mode", each new visitor is met with a "Captcha" security challenge, which they must pass before being given a cookie for unchallenged access. That way, botnet traffic is blocked until the "Defense Mode" is turned off. Visitors that do not meet the security challenge are added to the (bad) IP Reputation database.