In the middle of a coordinated denial-of-service attack on an entire country, the IT chief of Estonia's leading newspaper made a decision I think about every time someone tells me their site is "basically just hosting." He keyed a few lines of code, pressed Enter, and cut his paper off from the entire world outside Estonia. He did not do it because the attackers were sophisticated. He did it because in those first days no better tool existed, and the alternative was the paper staying dark for everyone.
It was April 2007. Estonia, a country of 1.3 million that runs on the internet, had decided to move a Soviet-era bronze statue out of downtown Tallinn. The decision enraged Moscow and lit two nights of street riots. Then, from April 27, the country's digital life came under a sustained assault: waves of automated traffic that eventually crashed the sites of parliament, ministries, newspapers, and banks. The attacks came in pulses and, in some cases, lasted weeks. Estonian police charged one 19-year-old for encouraging the attacks in internet forums, and instructions for what to attack circulated online in Russian. I am not here to relitigate who gave the order. The interesting part is what the defenders did next.
The paper, the Postimees, normally served about a million pageviews a day. During the assault its servers were hit with 2.3 million and had crashed 20 times before the IT chief cut the international connection. Here is what that defense actually meant, and why I keep coming back to it: the site stayed reachable inside Estonia, and the bandwidth meter turned green the moment he did it, but to the rest of the world, Estonia's leading newspaper had vanished. The paper could not tell the world what was happening in its own country. Wired's account of the episode saw the shape of it - the same defense the city had used against invasions centuries earlier: close the gates, pull up the ramparts, settle in for a siege.
The siege defense is the honest ancestor of something every site owner eventually reaches for. Rate limiting is a siege defense. Geo-blocking is a siege defense. "Block all traffic from that ASN" is a siege defense. They work - the Postimees stayed up for Estonians that week - and they all carry the same cost the newspaper paid: the traffic you refuse to inspect is traffic you refuse to serve. A denial-of-service attack does not need to break anything to win. It just needs your cheapest effective response to be turning customers away.
Estonia's Computer Emergency Response Team escalated the same logic to national scale. When the attacks peaked in early May, CERT blocked foreign access to Estonian servers. Reuters reported that some sites faced up to 1,000 clicks a second against a normal level of 1,000 to 1,500 a day. Think about what a country does when it does that: a NATO member, the most wired country in Europe, made itself unreachable from abroad to stay reachable at home. Banks were down for only a short time by the standards of a national attack, which is the most hopeful sentence in this story. But the honest summary of the siege week is that availability became something you rationed by geography.
What beat back the bots was not ramparts. It was coordination - CERT head Hillar Aarelaid working the phones, persuading ISPs around the world to blacklist the attacking machines one by one. The siege bought time. Trusted people in a network, acting on evidence, reclaimed the open internet the gates had closed.
I run a paid-rank leaderboard, so the question I ask about any attack is what it does to trust, and a flood is a trust attack like any other. If a botnet wanted this leaderboard to mean nothing, it would not need to break a single thing. Making the board unreachable from outside is enough, or better, making it answer so slowly nobody can tell a defended site from a dead one. My answer is the boring one: the rank on Bid Spotlight moves only when a verified payment clears, and a rank can survive being slow. It cannot survive being wrong. So the machine spends its worry budget on verification, and rate limits exist to protect the verification - the trade is always stated in that order, never the other way around.
The siege defense also tells you something about what you are defending. By the paper's own account, the cut was not about protecting a database; a newspaper's whole product is being reachable, and the gates were the only way left to keep that product alive. Yours probably works the same way. So the question worth answering before an attack, not during one: if you had to choose between reaching your real users and keeping the attackers out, which users would you sacrifice, and would you even have the ability to make that cut?
Decide it now, while the site is up. Write down what you would block first, who has the authority to block it, and which single number you would watch to know the difference between a traffic spike and a siege. Then, when somebody's flood arrives, the gates close because you chose them - not because the ramparts were the only tool left.
The rank on Bid Spotlight does one thing a flood cannot imitate: it moves only when a real payment clears, and at no other moment. Decide what your own site's answer would be.