All products 
What VPS DDoS protection really includes
More than half the plans in the catalogue carry a "DDoS protection" label, including the cheapest ones. Behind the same words are different services: from basic filtering at the edge of the data centre network to a separate protected IP with application-level traffic scrubbing. Before renting a VDS for a game, a store or an API, work out exactly what you're being protected from.
L3/L4 and L7 are two different problems
Most attacks are volumetric, at the network and transport layers (L3/L4): UDP floods, SYN floods, amplification via DNS, NTP or memcached. The goal is to clog the channel or the connection table. Filtering at the provider works against them: traffic passes through scrubbing equipment before it reaches the server. This is what's usually called basic protection.
Application-layer (L7) attacks look like ordinary HTTP requests: thousands of bots open search, the cart, the login form. Their volume is small, and the network filter doesn't notice them. Different tools are needed here: a protective proxy or CDN in front of the site, request limits in nginx, a captcha, caching of heavy pages. For a website or an online store, the host's L3/L4 protection covers only half the risks.
What's included in the plan and what costs extra
- Basic protection included in the price. Automatic filtering of known flood types with limited capacity. If the attack is stronger, the host may send your IP to a blackhole: the server keeps running but is unreachable from the internet until the attack ends.
- Advanced protection. A separate protected IP or a plan with higher filtering capacity, sometimes with rules for specific protocols.
- L7 protection. Usually a standalone service: the domain is proxied through a filtering network, and the server's real IP is hidden.
What to ask the host before paying
- What the filtering capacity is and what happens when an attack exceeds it.
- Whether protection runs constantly (always-on) or kicks in after an attack is detected. In the second case the server may be unreachable for the first few minutes.
- How UDP is filtered. Game and voice protocols suffer from crude rules: real players drop off along with the flood.
- Whether incoming attack traffic counts towards the plan's limit, and what happens with repeated attacks.
- Whether you get notified of attacks and whether they're visible in the panel.
Who needs protection most
Game projects are attacked most often: Minecraft and Rust servers, RP projects on RAGE MP and FiveM. Ordering a flood is cheap, so fine-tuned rules for game protocols matter more here than CPU power. The second risk is stores and services during sales. For a small corporate VPN gateway or a test environment, the basic protection that most plans already have is enough.
The table above collects plans where the host itself claims DDoS protection; prices are converted into your currency, and the "Payment" column shows whether you can pay by card, PayPal or cryptocurrency. Hosts describe protection capacity and terms in different ways, so check them with support.