This is a very good explanation but there is another side to this issue. (I`m talking about HTTP DDOS) Basically, DDoS Attacks can be (roughly) divided in 2 ca

This is a very good explanation but there is another side to this issue. (I`m talking about HTTP DDOS) Basically, DDoS Attacks can be (roughly) divided in 2 categories: 1. Attacks on your server (which usually target your server IP or some other part of your network infrastructure) 2. Attacks on your site (which use bots to flood your site with fake HTTP requests) As explained above, Network attack can only be countered with strong and flexible infrastructure. The most common solution is a combination of several high-powered servers and load balancing capabilities. HTTP DDoS attacks are trickier because they're best mitigated by visitor profiling, a technology that can help identify bots from humans and block them while still allowing providing full access to all legitimate visitors. Developing and maintaining such technology is arguably more complicated, simply because it's a software you need to create, not a hardware which you can buy. Standard profiling solutions include CAPTCHAs and Delay Pages but these will also repel legitimate visitors. (because no one likes CAPTCHAs or waiting for 5-10 extra seconds for page load). Advanced profiling solutions use a combination of behavior and signature recognition, coupled with seamless challenges (i.e. checking for JS support). CF and Incapsula (where I work) both handle Network DDoS in a similar manner but we have a somewhat different approach to HTTP DDoS. And yes, while under DDoS (or even without it), dynamic resources can be the "weakest link". This is why WAFs are so important.