How does a distributed denial-of-service attack prevent legitimate users from reaching a website?

A distributed denial-of-service (DDoS) attack prevents legitimate users from accessing a website by overwhelming the target's servers with a massive volume of automated requests.123

Rather than originating from a single source, these requests are sent simultaneously from a large network of compromised devices known as a botnet. These devices, often referred to as "zombie computers," are typically infected with malware—such as Trojan horses—that allows an attacker to trigger them remotely.134

By flooding the target with this high volume of traffic, the attack effectively ties up the server's resources, making it unable to process or respond to requests from legitimate users. This method is frequently used in cyberwar and other conflicts to disrupt government, financial, and commercial communications. Because these attacks leverage a vast array of infected machines, they are often difficult to defend against, even with robust security measures.142