Embodiments of this application disclose a website attack detection and protection method and system performed by a computing device, applied to the field of information processing technologies. In the method in the embodiments, the computing device calculates a parameter value of an information aggregation degree parameter corresponding to each field included in a header of a request for accessing a website, and then determines, according to the parameter value or a variation degree of the parameter value of the information aggregation degree parameter of the field, whether the website suffers a Challenge Collapsar attack.