How does a website crash?

Three are three basic approaches to attacking a website: hack and enter, inside jobs, and denial of service (DOS).

DOS attacks are the easiest, as they don't really need to get into the site itself. The site is simply spammed with traffic like ACK/NAK or ping requests, and due to overload becomes inaccessible. There are effective countermeasures that can be applied against a DOS attack, but these vary in effectiveness depending on the magnitude and sophistication of the attack.

Hack and enter attacks are comparatively rare, and depend on known security flaws or vulnerabilities. These take the form of allowing an intruder to take control of the site, enter content to the site or, most dangerous, enter executable commands to the site. Unsurprisingly, inserted code can easily crash or take over control of a website and potentially the underlying systems/network.

Typically, these are enacted by attacking known vulnerabilities that haven't been properly patched by the site admin, but may exploit previously unknown vulnerabilities as well. Good firewall and patch management will help to secure against this attack -- usually.

Finally, privileged insiders may either plant back doors, or leave with access information that often isn't changed when employees leave. This is, by far, the most common cause of system espionage and vandalism.