Knowledge Base

Operations - 5 min read - Updated 2026-07-10

DDoS response checklist

What to check, what to preserve, and what to avoid when a game server is under a traffic spike or active attack.

Confirm symptoms before changing configuration

During a suspected DDoS event, avoid making several emergency changes at once. First confirm whether players are seeing packet loss, connection timeouts, high ping, or a full server process crash. Those symptoms can point to different causes.

  • Check whether the game process is still running.
  • Compare reports from multiple player networks.
  • Record when the issue started and whether it follows a match, stream, or public announcement.
  • Preserve relevant console output and error messages before restarting repeatedly.

Reduce exposed services

Keep only the ports and services that players need. Extra query ports, test panels, old voice servers, or unmanaged plugins can make troubleshooting harder during an attack window.

If you recently published a new IP address, server list entry, or public event, include that timing in the support ticket so the provider can correlate traffic changes.

Avoid self-inflicted downtime

Repeated restarts, plugin removals, and firewall experiments can create downtime that looks like the attack itself. Make one change, wait long enough to observe the result, and keep a short timeline of what changed.

  • Do not move DNS repeatedly during an active event unless support tells you to.
  • Do not publish alternate backend addresses in public chat.
  • Do not disable required protection or firewall rules to test quickly.
  • Do not delete logs before the attack window has been reviewed.

Communicate with players

Post a short status update in the place players already check, such as Discord or a website status channel. Give the symptom, the start time, and the next update time. Avoid sharing backend IPs, provider details, or speculation about attackers.

After service is stable, keep the incident notes. They help identify repeated timing patterns, targeted events, and configuration changes that reduced impact.

Need help applying this?

Send us the game, player region, and what you are trying to change. We will point you to the safest next step.