Embodiments of the present application relate to a method and device for defending against website attacks. The method includes obtaining a traffic threshold value corresponding to a target IP address, determining whether real-time visitor traffic for the target IP address exceeds the traffic threshold value, and handling visitor traffic for the target IP address based at least in part on whether the real-time visitor traffic for the target IP address exceeds the traffic threshold value, wherein the handling incoming visitor traffic for the target IP address based at least in part on whether the real-time visitor traffic for the target IP address exceeds the traffic threshold value includes, in the event that the real-time visitor traffic for the target IP address exceeds the traffic threshold value, configuring a blackhole route for the target IP address, and redirecting the incoming visitor traffic for the target IP address to the blackhole route.