The site dies during an ad campaign: growth or an attack
Ads are on, traffic exists, the server chokes. How to tell a successful campaign from bots without buying every shield at once.
Store owners know the symptom: the campaign started, leads should rise, and pages open only sometimes. Sometimes that is a real spike. Sometimes bots and availability attacks pretend to be people. Until those are separated, any protection purchase is a guess.
What to look at in the first hour
- Whether it is one URL or the whole site. Checkout and the catalog often deserve their own graph.
- Whether the requests look human: the same paths, an empty referrer, odd user-agents, a spike from one network.
- Whether the server is hitting a hosting limit that was already tight before the ads.
- Whether cache and static files are alive. If every visit rebuilds the page, the "attack" is your own layout.
Which layers make sense
DDoS protection is not a hoster toggle. A working set is usually edge filtering, cache, limits on forms and APIs, a tuned WAF and a short plan for who does what when the site is already down. An hour of downtime hits sales and the index, but "turn everything on" without a diagnosis only adds false blocks for real customers.
A store hurts most when checkout dies while the storefront still opens. Those paths are better split and watched apart. Lexora helps tell growth from an attack and assemble WAF, DDoS protection and observation so the response does not start as panic in chat.
Related Lexora services
Did the site fall on campaign day?
We will separate growth from an attack and say what to enable first.