# Was our website outage a cyber attack? How do we find out?

Check the ordinary causes first, then look for the signs of an attack. Many outages come from an expired certificate or domain, a full disk, a failed update or a problem at the hosting provider. Ask your provider and check its status page, then look at the web server's logs: a sudden flood of requests from many addresses points to a denial-of-service attack; changed pages, new administrator accounts or unknown files point to a compromise of the site itself; a changed DNS record points to an attack on your domain registration. Keep the logs before restarting anything. If the site holds customer data or takes payments, treat a compromise as a possible data breach. NetSenX does not protect public websites hosted outside your network; if the web server sits in your network, it shows unusual outbound connections and data volume from it.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/was-our-website-outage-a-cyber-attack

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [Does network detection stop DDoS attacks, and how does it differ from DDoS protection?](https://netsenx.com/en/faq/does-network-detection-stop-ddos-attacks)
- [What does NetSenX give us during an incident?](https://netsenx.com/en/faq/what-does-netsenx-give-us-during-an-incident)
- [A supplier with access to our systems has been hacked. What do we do?](https://netsenx.com/en/faq/a-supplier-with-access-to-our-systems-was-hacked)
- [Is it a compromised account or a compromised device, and why does it matter?](https://netsenx.com/en/faq/compromised-account-or-compromised-device)
- [What are the early warning signs of ransomware on a network?](https://netsenx.com/en/faq/what-are-the-early-warning-signs-of-ransomware-on-a-network)