Denial of service is widely treated as a solved problem. For a well-resourced platform behind a large network, it broadly is. For a newsroom running a modest server on a modest budget, an attack costing the sender very little can take the site off the internet for exactly as long as it matters.
Timing is the whole attack
The attacks we see against newsrooms are not sustained campaigns. They are short, sharp, and correlated with publication, beginning within an hour of a story going live and ending once the news cycle has moved on. The objective is not permanent removal. It is friction during the window when the piece would otherwise spread.
Nobody needs to take your site down forever. They need it down while people are looking for it.
Preparation that survives contact
- Put the site behind a network that absorbs volume, and confirm the origin cannot be reached directly.
- Cache aggressively so that a static copy can serve while the application struggles.
- Keep a lightweight static mirror you can switch to by DNS, and rehearse the switch.
- Have a syndication partner who can carry the piece if your own site is unreachable.
- Know your provider’s escalation path before you need it at midnight.
The bitter irony of DDoS against small publishers is that the defence is well understood and mostly cheap. It just has to be in place beforehand. Configured the week after an attack, it protects the next story instead of the one that mattered.