How Tilton went from 4 outages a day to zero and cut hosting costs in half
Tilton Coffered Ceilings was going down about four times a day under DDoS attack. Triotech stopped the attacks at the edge, rebuilt the store on AWS with zero outages in 4 years and cut hosting costs in half.
The situation
Tilton sells coffered ceilings and architectural building materials online to contractors and homeowners across North America. For an online store, the website is the business: when the site is down, nobody can buy. Tilton came looking for a DevOps team because the store was going down about four times a day, and two problems were working together. The store was under constant DDoS attack. More than 90% of its traffic came from outside the US, from countries Tilton doesn't sell to, arriving at tens of thousands of requests at a time. With nothing in front of the site to filter it, that traffic buried the server and real shoppers couldn't get through. The platform couldn't absorb it. The whole store ran on one AWS Lightsail instance: the WordPress site, the database and the web server on the same machine. When attack traffic overloaded it, the storefront, checkout and database all went down together. The previous team's answer was to keep buying a bigger instance. Each upgrade raised the hosting bill, but a bigger server is just a bigger target. The attacks kept coming, and so did the outages: lost orders, ad spend sending shoppers to a dead page, and buyers who might not come back.
The constraint
- Active, high-volume attacks. Tens of thousands of malicious requests had to be stopped while they were happening.
- Most traffic was fake. With over 90% of traffic coming from outside the US, real customers were a small minority of the load.
- A single point of failure. The application, database and web server shared one machine, so an attack on any part took down all of it.
- Costs rising, reliability not. Each upsize made the bill bigger and the outages no more rare.
- A platform in transition. The store was moving from WordPress to Laravel, and the infrastructure had to support both through the change.
- An offshore development team. Developers worked from outside North America and needed secure access without exposing the servers.
- A live business. The store had to keep taking orders while everything underneath it was rebuilt.
What we did
- Stopped the attacksThe first priority was getting the store up and keeping it up. We put Cloudflare in front of the store, so attack traffic was stopped before it ever reached the server. DDoS protection: traffic floods absorbed at Cloudflare's edge, before they reach Tilton's infrastructure. Country blocking: cut the non-US traffic that made up over 90% of requests, from regions Tilton doesn't sell to. Rate limiting: no single source can flood the store with thousands of requests. WAF rules and CAPTCHA: malicious requests and bots blocked without blocking real shoppers. Edge caching: page rules serve content from Cloudflare and take load off the server. The server could finally spend its resources on real contractors and homeowners.
- Diagnosed with dataThe billing history and server metrics told the story: each bigger Lightsail instance cost more, and the outages continued. We used that data to recommend a new architecture instead of another upgrade, and Tilton agreed.
- Rebuilt on AWS-native servicesWe replaced the single all-in-one server with a platform built for the store. Separate EC2 application servers, so the application no longer competes with the database for resources. A managed Amazon RDS database, with backups and patching handled by AWS, so the app and database no longer fail together. Blue-green environments: two production environments, one live and one ready, so new releases go to the idle one and traffic switches only when it's ready. Right-sized infrastructure, matched to Tilton's real traffic instead of an ever-growing instance.
- Tuned every layer for speedA stable store also has to be fast. Environment: server and application settings tuned for the store's workload. Database: tuned so product pages and checkout respond quickly under load. Caching: repeat requests served fast without hitting the database every time, alongside Cloudflare's edge caching.
- Supported the move from WordPress to LaravelTilton's offshore development team built the new Laravel application. Triotech provided the platform to run it: environments, database and deployment pipeline. The store moved from WordPress to Laravel without the outages coming back.
- Automated releasesWe built a CI/CD pipeline with Bitbucket, AWS CodeBuild and AWS CodeDeploy. Developers' code is built, deployed to the idle environment and switched over without taking the store offline. Shoppers never see a release happen.
- Secured access for an offshore teamThe development team connects to the servers through a VPN. No admin or server access is exposed to the open internet, which matters all the more when most incoming traffic is hostile.
- Run it, every dayWe've run Tilton's DevOps and security ever since: monitoring, maintenance, updates, security rules and a fast response when anything needs attention.
- Grew with them, from infrastructure to marketingWith the store stable and secure, Tilton handed its Google Ads, PPC and digital marketing to a Triotech marketing team. Same budget, more sales, sustained month after month.
How traffic reaches the store now
- 1A visitor requests a page.
- 2Cloudflare checks the request: location, rate, bot signals and WAF rules.
- 3Attack traffic, bots and blocked regions are stopped at the edge.
- 4Cached pages are served straight from Cloudflare.
- 5Only real shoppers reach the application servers, which use caching and the optimized RDS database to respond quickly.
Zero outages in 4 years.
The result
Technology
Technology
Edge and security: Cloudflare (DDoS protection, WAF, rate limiting, CAPTCHA, country blocking, page rules, edge caching) · VPN Cloud: AWS EC2 · Amazon RDS · AWS CodeBuild · AWS CodeDeploy Performance: Database optimization · application caching Delivery: Bitbucket · blue-green deployment Applications: Laravel (originally WordPress) · PHP · SQL Marketing: Google Ads · PPC
Find out what your stack is hiding.
If your store keeps going down and each fix costs more than the last, the problem usually isn't the size of your server. It's what's hitting it, and how it's built. Book a free audit and we'll show you where to start.