Why short bursts are effective
A brief flood can exhaust connection limits and slip past reactive mitigation that takes minutes to engage. The site recovers before anyone diagnoses it.
Practical protection for small sites
A CDN or proxy in front of the origin absorbs most volumetric attacks, and hiding the origin address stops attackers bypassing it.