$104,500 — a DDoS on one sound file ran a free static site to a $104K bill

What happened

A developer ran a small Cantonese-language static site, jyutping.org, on Netlify's free tier for four years. It averaged around 200 visitors a day and never used more than about 10GB of bandwidth a month. One weekend an email arrived saying $104,500 was overdue. The dashboard showed 190TB of bandwidth in four days, with one day peaking above 60TB. A distributed attack had hammered a 3.44MB MP3 file hosted on the site. Netlify bills $55 per 100GB over the free allotment, so the traffic converted straight into a six-figure charge. There was no spend cap and no alert, and the only email was a receipt for the extra bandwidth package. Support first offered to reduce the bill to 5 percent, about $5,000, as a courtesy.

Root cause

Netlify's free tier includes bandwidth but does not cap spend. Once traffic passes the allotment, overage bills at $55 per 100GB with no ceiling and, here, no proactive alert. A static host has no application layer to rate-limit an attacker, so a flood aimed at one large asset turns directly into bandwidth cost. The included quota looked like a hard limit but was really just the point where metered billing began.

How to avoid it