Why short bursts are effective

A brief flood can exhaust connection limits and slip past reactive mitigation that takes minutes to engage. The site recovers before anyone diagnoses it.

Practical protection for small sites

A CDN or proxy in front of the origin absorbs most volumetric attacks, and hiding the origin address stops attackers bypassing it.