I have a website. Suppose someone will code a program that will click continuously on the links of my webpage: could this lead to a DoS attack ?

  • 10
    Nobody needs to write a program to click on your links. They just need to write a program that duplicates the requests that are generated when those links are clicked. This can be done much faster than anything that has to simulate UI interaction, and doesn't even need to wait on your site to process one request before the next is sent.
    – Iszi
    Jul 29, 2014 at 16:44
  • 2
    What research have you done? There is lots written on denial of service (and there's lots on this site, under the tag denial-of-service). You might want to start by reading the Wikipedia article on denial-of-service; see, e.g., application-level floods and unintentional denial of service, which seem to cover your situation. As the FAQ explains, this is a site for information security professionals; if you are new to this area, it helps to do some research before asking, to help you pose a more narrowly crafted question.
    – D.W.
    Jul 29, 2014 at 17:30

2 Answers 2


The question is a bit vague, the short answer is Yes clicking on links could DoS your site.

A for a more in-depth answer you would need to look at what those links are doing. For example if every time you clicked a link it ran some monstrous database query that used all your CPU power or Disk IO, or if the links played a video that would quickly saturate your outbound bandwidth it wouldn't take a lot of clicking to DoS your site.

I've seen this happen with people's personal blog that's hosted at home on an ADSL connection and more than one person viewing a video at a time DoSes their site.

On the other hand if your links were to static HTML or something easily cached it would take a whole lot of clicking to DoS your site.

  • see related: en.wikipedia.org/wiki/Slashdot_effect - lots of honest traffic (flash mob) causing a website to go down. Just people clicking to view the site. Not that far of a stretch of many people clicking a link once... to one person clicking many times.
    – WernerCD
    Jul 29, 2014 at 15:04
  • @WernerCD: That would depend on the bandwidth of the client, most servers should be more capable than a single client. The problem with being slashdotted is that you can't efficiently block requests, as it's essentially a DDoS "attack".
    – Bergi
    Jul 29, 2014 at 17:13
  • @Bergi The question is: Can simple clicks lead to DoS? Specifically, me clicking real fast (paraphrased). Of course the bandwidth available will affect how many clicks lead to a "DoS". A self-hosted website, behind a home connection will need much fewer clicks than something hosted on a high-availability AWS... This question made me think of the slashdot effect because that's basically what it is, death by a million clicks.
    – WernerCD
    Jul 29, 2014 at 19:32

Actually, sending a lot of requests (and wildly clicking is one of the way of doing that) is what the DoS is about.

DoS is not about sending some specially prepared data that will kill your site (like exploits, ping of deaths etc.). It's about sending a lot of requests which are cheap to send but takes a long to process.

If someone writes the program that would 'click' the link (send GET/POST) and then receive/parse the response, it would be very inefficient since they will exhaust their resources (network bandwitch, CPU, memory) probably much quicker than your site.

Much more effective would be to send-and-forget the GET (don't read the data that your server is returning).

If your server creates a new session for every visit, and that session is expensive, such program can quickly kill your server. My collegue has said his client's JSF site was killed by google bot, because google bot visited each link without cookies, so every subpage visited has caused the creation of a new JSF session, which are quite expensive.

  • 17
    Actually, DoS can very well be about sending prepared data to the server. What you are thinking about is DDoS. It would be very hard for one person alone to DoS a page without sending prepared data which exploits a weakness of the site.
    – tim
    Jul 29, 2014 at 9:58
  • 2
    @tim I doubt we've seen the last DOS that uses something like NTP to saturate connections. As long as we develop new software, we will have new exploits to go along with it that allow a single person to DOS a website with surprisingly little effort.
    – Nzall
    Jul 29, 2014 at 11:06
  • This is factually incorrect. You are describing only one kind of attack, called a layer 4 attack (using OSI terminology). Other attacks are often far more successful such as slow POST attacks. Not to mention, the description you give is for a non-existent form of bandwidth exhaustion attack. DoS attacks do not involve spamming GET requests, but rather things like spamming connection requests to exhaust the system's open socket limit, or trying to saturate the downlink with heavy UDP traffic (e.g. from a smurf attack).
    – guest
    Nov 19, 2017 at 8:37