Your Flashcloud-hosted site already has DDoS protection running before you configure anything. Cloudflare sits at the DNS layer for every shared and WordPress hosting account, absorbing the volumetric attacks that try to knock a domain offline, and Imunify360 runs at the server as a web application firewall against attacks aimed at your application itself. If you're seeing a sudden traffic spike or suspect an attack in progress, the fix that helps most sites is turning on Cloudflare's proxy mode, covered below.
Not every flood of traffic is an attack, and not every attack looks like a flood. Knowing the difference tells you which layer is actually handling it.
Types of DDoS attacks
DDoS (distributed denial of service) attacks come from many machines at once, which is what makes them hard to block with a simple IP ban. They generally fall into three categories:
- Volumetric attacks flood your connection with junk traffic (UDP floods, DNS amplification, ICMP floods) trying to saturate bandwidth before requests ever reach your server.
- Protocol attacks exploit weaknesses in how servers handle connections, like SYN floods that open thousands of half-finished TCP handshakes to exhaust connection tables.
- Application-layer attacks send what looks like normal traffic, HTTP requests hitting a login page or search form repeatedly, but at a volume designed to exhaust CPU, database connections, or PHP workers. These are harder to spot because each request is individually legitimate.
Volumetric and protocol attacks are typically stopped upstream, before they reach your hosting account. Application-layer attacks need something inspecting request patterns and content, which is where a WAF comes in.
What's already protecting your site
Two layers run by default on Flashcloud shared and WordPress hosting, no setup required.
Cloudflare at the DNS layer
Cloudflare is our DNS provider (ns1.flashcloud.com / ns2.flashcloud.com), and that alone puts real protection in front of your domain. Anycast DNS means lookups answer from the nearest Cloudflare edge location worldwide, so your domain stays resolvable even during an attack targeting DNS infrastructure elsewhere. This is the same edge network described in setting up a CDN with Cloudflare, and it's active whether or not you've turned on proxy mode.
Imunify360 at the server
Every request that reaches your hosting account passes through Imunify360, a web application firewall that inspects requests for known attack patterns: SQL injection attempts, cross-site scripting payloads, malicious file uploads, and the kind of abusive request patterns used in application-layer DDoS attempts. It runs alongside ImunifyAV malware scanning, so an attack that manages to slip something onto the server gets caught on the scanning side too.
Because we run LiteSpeed Web Server with LSCache, a lot of application-layer load also gets absorbed before it ever touches PHP. Cached pages serve from memory in milliseconds, so a flood of requests hitting your homepage doesn't translate into a flood of database queries. See how we make your site fast for how that caching stack fits together.
Turning on proxy mode for active protection
DNS-layer protection keeps your domain resolvable, but by default, HTTP requests still travel straight to your origin server. Proxy mode, the "orange cloud" setting on a DNS record, routes that traffic through Cloudflare first. Cloudflare inspects and filters it, absorbing volumetric floods and challenging suspicious clients before they ever reach your hosting account. This is the setting worth flipping on if you're actively under attack or expect to be a target: sites getting press attention, running high-value transactions, or that have been targeted before. On eligible plans, you'll find the proxy toggle in the Cloudflare panel on your service page. Full setup detail, including when it's worth doing outside of an active attack, is in setting up a CDN with Cloudflare.
One tradeoff to know before flipping it on: proxy mode caches content at the edge, which is great for static files and can cause stale content on dynamic pages if cache rules aren't tuned. Review the caching cautions in that article before turning it on for a site with frequently changing dynamic content.
What to do during an active attack
If your site is slow or unreachable and you suspect an attack rather than a legitimate traffic spike:
- Check whether proxy mode is already on for your domain's DNS records. If it isn't, turn it on.
- Look for a pattern: repeated requests to a single URL, an unusual spike from a narrow set of countries, or requests with suspicious user agents. This helps distinguish a real attack from a traffic surge (a viral post, a marketing campaign).
- Avoid making other changes to DNS or hosting settings while traffic is elevated. Changes can take time to propagate and add confusion to diagnosing what's happening.
When to contact support
If you believe your site is under active attack, especially if it's already down or proxy mode alone isn't stabilizing things, open a ticket from the portal under Support > New ticket, or reach us on live chat. Flag it as an active incident. Our team can look at server-level logs alongside what Cloudflare and Imunify360 are seeing, which gives a fuller picture than either layer alone. This is a real-human queue, not a bot, so include your domain and what you're observing (down entirely, slow, specific pages affected) to speed up triage.