DDoS protection: what hosting providers actually give you

Every second host now lists "DDoS protection" in its plans. Behind that line there may be multi-terabit filtering, or only the right to take your address offline when an attack bothers the neighbours. Here is what protection is made of, how L3/L4 differs from L7, and how to tell from the contract what you are buying.

Updated 03.11.2026 · Find a VPS for your needs →

A DDoS attack is a flood of requests from many machines meant to overload a server or its link so that real visitors cannot reach it. Protection against it is built on the host's network or at an external filtering provider: suspicious traffic is separated from normal traffic and dropped before it reaches the server. The server itself cannot cope with a large attack: once the link to it is full, no settings inside the system will help.

Attack layers: L3/L4 and L7

Attacks are classified by network-model layer, and each class is handled differently.

Volumetric attacks (L3/L4) fill the link: so much traffic heads for the server that its port or the data centre's upstream links are saturated. Their size is measured in gigabits and terabits per second.
Protocol attacks (L3/L4) exhaust not the link but the resources that track connections: firewall state tables, the queue of new TCP connections. They are measured in packets per second (pps, Mpps). Some of them are also handled on the server itself, for example with SYN cookies (RFC 4987).
Application attacks (L7) look like ordinary HTTP requests to a site or API: search, cart and login pages. The link stays almost idle while the web server or database goes down. They are measured in requests per second (rps) and are told apart from visitors by behaviour, not volume.

L3/L4 network filtering is what hosts usually switch on for every customer. L7 protection is harder: the filter has to understand your site, see the contents of HTTPS requests and tell a visitor from a bot. That is why it is more often sold separately, connected through a proxy holding your certificate, or left to the site side: a CDN, a WAF, request rate limits in the web server.

"Protection enabled" versus real filtering

According to the accsly catalog as of 3 November 2026, 1,117 of the 2,236 hosts with VPS plans claim DDoS protection, exactly half. Details could be found for 219 hosts in the catalog, and the picture is mixed:

35 hosts state the filtering capacity in Gbps or Tbps;
24 state the protection layer (L3/L4 or L7);
8 mention L7, and for half of them it is paid or enabled on request;
in roughly a quarter of the cases protection is a separate paid option, and in roughly another quarter it is explicitly included in the price.

The rest keep it short: "yes", "claimed", "built-in network protection". That is not necessarily bad, but such a phrase does not tell you what will happen during an attack. Three different things hide behind the same words:

Always-on filtering. All traffic always passes through the filter. An attack is cut off at once, but the filter sometimes catches normal traffic too, for example game protocols over UDP.
On-demand filtering. The system watches traffic and turns scrubbing on when the flow crosses a threshold. Seconds or minutes pass between the start of an attack and the filter kicking in, and the server may be unreachable during that time.
Blackhole only. There is no real scrubbing: during an attack the host's network simply stops passing traffic to your address. That protects the neighbours and the host, but not you.

Threshold and blackhole

Every protection has a limit: a volume or packet rate beyond which the host stops filtering. The rules usually say something like "for attacks above N Gbps the address may be temporarily taken offline". This is done with a blackhole: the operator tells neighbouring networks to drop traffic to your address. BGP has a standard BLACKHOLE community for this (RFC 7999), and where possible exactly one address is taken offline, a /32 for IPv4 or a /128 for IPv6, so that neighbours are not affected.

For the server owner this means a simple thing: the attack reaches its goal, just on the network rather than on your server. The address is unreachable for everyone until the blackhole is lifted, and the duration differs between hosts, so look for it in the rules too. If the project cannot survive such downtime, the filtering threshold must be well above the attacks you realistically expect, and the site should have additional L7 protection in front of it.

One more detail is the port. On a plan with a 100 Mbps port even a small attack fills it completely, and the host's filter has to cut it off before it reaches your port. How to read port speed and shared links is covered in Bandwidth and traffic: what 1 Gbps and unlimited really mean.

What to ask the host and check in the contract

Layers. Only L3/L4, or L7 as well? If L7, how is it connected: through a proxy, by changing DNS, with or without your certificate.
Capacity. How many Gbps and how many million packets per second the filter handles per address, not for the whole network.
Mode. Is filtering always on or triggered by a threshold, and how long does it take to kick in.
Beyond the threshold. Is the address taken offline, for how long, can it be brought back sooner, and what does an upgrade to higher protection cost.
Where the filter sits. In the data centre itself or at an external provider; does protection cover all the host's locations — sometimes it exists in only one city.
Price and terms. Is protection included in the plan or a separately paid option, and is there a charge per mitigated attack.
Liability. Does attack time count towards the availability SLA. Often it does not: the rules exclude attacks from the guarantee.

Get the answers in writing, in a support ticket: if the host's website says little, these are your terms. General tips on reading a plan are in How to read hosting plans: the hidden limits.

What to do yourself

Even with good protection from the host, part of the work stays on your side:

close everything except the ports you need with a firewall and enable SYN cookies — most Linux distributions already have them on; the basic setup is described in First 10 steps after buying a VPS: security;
for a site, rate-limit requests to heavy pages (search, login, cart) right in the web server and put a CDN with L7 protection in front of the site;
if the site is behind a CDN or proxy, do not publish the server's direct address in DNS or in emails, otherwise traffic will go around the filter;
watch availability from outside to learn about an attack before visitors do — see Server monitoring: uptime, load, alerts;
keep a fresh backup and a moving plan: if the host cannot cope, the project can be brought up elsewhere.

Plans where protection is included in the price are collected in VPS with DDoS protection. Game servers need protection more often than others, usually L3/L4 for UDP: see VPS for a game server and dedicated servers for games.

FAQ

How does L3/L4 protection differ from L7?

L3/L4 filters network traffic by volume and packets, protecting the link and connections. L7 inspects HTTP requests to the site and tells visitors from bots. Hosts usually include the first for everyone; the second is more often sold separately or set up through a CDN.

What does "DDoS protection included" in a plan mean?

Only that the host has some kind of filtering. It may be always-on scrubbing of terabits, a filter triggered by a threshold, or just taking the address offline during an attack. Ask about the layer, the capacity per address and what happens beyond the threshold.

What is a blackhole during a DDoS attack?

The host stops passing all traffic to the attacked address, usually exactly one IP. That protects the rest of the network, but your server is unreachable for everyone in the meantime.

How long does a blackhole last?

There is no single rule: some hosts lift it after a fixed time, others when the attack ends. Look for the duration and the option to lift it sooner in the rules, or ask support before you pay.

Does a small website need DDoS protection?

The host's basic network filtering plus a CDN in front of the site is usually enough. Separate paid protection is worth it when downtime costs money: an online store, a game server, a service with paying customers.

Does attack time count towards the uptime SLA?

Often not: many hosts' rules exclude DDoS attacks from the availability guarantee. If this matters to you, look for that clause in the SLA specifically.

Plans on this topic

Best VPS hosting 2026

More in the guide

Cloud server or VPSA cloud server and a VPS are usually the same KVM virtual machine. The difference lies in what surrounds it: a cloud sells resources by the hour through an API and offers network disks, snapshots and ready-made services, while a classic VPS is a fixed monthly plan with a local disk and a traffic allowance. Here is which of this you actually need and what it costs.
Dedicated server or VPSA VPS is a slice of a physical server, a dedicated server is the whole machine. With 4 cores and 8–16 GB of memory a VPS costs almost half as much, with 4 cores and 32 GB the prices are equal, and with 64 GB on 8 cores or 128 GB on 16 cores a dedicated server in the catalog is a third cheaper than a virtual one. Here is what else changes besides the price: neighbours, guarantees, delivery time, hardware failures and remote management.
Shared hosting or VPS for a websiteShared hosting is a ready place for a site where the host looks after the server. A VPS is your own server where you set everything up. For a landing page or an ordinary WordPress site, hosting is enough and costs several times less. You need a VPS when the account limits are too tight for the site or when it needs software that hosting does not allow. Below is what each option includes, what it costs and a table to help you choose.
Mail server on a VPS: SPF, DKIM, DMARCInstalling Postfix or a ready-made bundle like Mailcow on a VPS takes an hour. Getting your mail into the inbox rather than spam is harder: mailbox providers look at the port, the server's address, its reputation and three DNS records. Here is what to check with the host before buying and how to set up SPF, DKIM and DMARC.
Server monitoring: uptime, load, alertsWithout monitoring you learn that the server is down from your visitors, and that the disk is running out when the database stops writing. A few checks from outside and a dozen metrics from inside are enough to see a problem before users do. Here is what to measure, where to run checks and how to do it for free.
How to read hosting plans: the hidden limitsA plan card shows cores, memory, disk and a monthly price. Yet two plans with identical numbers can cost different amounts a year later and behave differently under load. The difference lies in terms printed in small type, in the acceptable use policy, or only in the contract. Below are eight places worth checking before you pay.
IPv4 and IPv6 on a serverA typical VPS has one public IPv4 address and, if the host supports it, an IPv6 subnet. An extra IPv4 address almost always costs money, and the cheapest plans sometimes come without their own IPv4 at all. Here is where the shortage comes from, what you can do with IPv6 alone and which address settings a mail server needs.
Bandwidth and traffic: what 1 Gbps and unlimited really meanA server plan usually has two network lines: port speed and traffic volume. The first says how fast the server can send data, the second how much it can send in a month. They are linked by simple arithmetic, and once you know it, it is easy to see what "1 Gbps unlimited" actually offers and whether "5 TB" will be enough for you.
Docker on a VPS: getting startedDocker lets you run a bot, a website, a database and monitoring on one server without them getting in each other's way, and moving to another VPS comes down to copying a couple of files and the data. Installation takes five minutes; the real trouble starts later: database ports exposed to the internet, logs growing to tens of gigabytes and data that vanished along with a container. Here is how to avoid all of that from the start.
How to move a website from shared hosting to a VPSThe move itself takes a couple of hours; the mistakes usually happen around it: a forgotten cron job, .htaccess rules that nginx does not read, an AAAA record with the old address, or mail that disappeared along with the IP change. Below is the order of steps with commands and checks for a PHP and MySQL site.
Server control panels: ISPmanager, FASTPANEL, aaPanelA panel turns a VPS into the kind of dashboard you know from shared hosting: sites, databases, mail and certificates are set up with a few clicks instead of editing config files. The three panels most often installed on Russian and budget international servers are ISPmanager, FASTPANEL and aaPanel. They differ in price, memory requirements and how much of the server they take over.
Windows VPS for 1CA rented server for 1C saves you from the office PC under a desk that nobody updates or backs up. But 1C on a VPS has its own quirks: the software licence is tied to the parameters of the virtual machine, users need both 1C and Windows licences, and core speed matters more than core count. Here is how to put together a 1C server for a small company.
Windows VPS: licensing, RDP and secure sign-inA Windows server costs more than Linux not only because of memory: the price includes a licence, and how it is arranged decides whether you are compliant and how many people can connect. An exposed RDP port is also the most common way such servers get hacked. Here are both topics.
When to move from shared hosting to a VPSA VPS does not make a site faster by itself: it gives you resources and freedom, and with them the job of running a server. Here is how to tell that hosting has become too small, when the problem can be solved without moving, and how to migrate a site so visitors notice nothing.
VPS backups: strategies and toolsOn a VPS, backups are your job, even if the plan says "backups included". We go through what exactly to back up, why a host snapshot is not enough, how to set up restic or BorgBackup in half an hour, and how to make sure you can actually restore from a backup.
First 10 steps after buying a VPS: securityBots start guessing passwords on a new server within minutes of it getting a public IP. Below are ten steps that close the most common holes in about an hour: commands for Ubuntu and Debian, the differences for AlmaLinux and Rocky Linux, and the checks that keep you from locking yourself out of your own server.
How to choose a country for your serverPut the server where your visitors are. For an audience across Europe, Germany, the Netherlands and Finland are convenient; for North America, the US East Coast. If you serve EU users, keeping the data in the EU makes GDPR simpler. Price hardly decides it: at the same host a server in Frankfurt, Amsterdam or New York usually costs the same, and only Asia and Australia are noticeably more expensive.
Hourly billing: when it pays offHourly billing pays off if you need the server for less than three weeks a month: for a test, a build, a one-off heavy job. At most hosts an hour costs exactly the monthly price divided by 730 hours, so over a full month you hardly overpay. The overpayment hides elsewhere: hourly plans are dearer on average, and for a server that runs all year, monthly billing or a year paid in advance usually comes out cheaper.
How much RAM and how many cores a website needsMost websites are fine with 2 GB of memory and one or two cores; a shop with thousands of products needs 4 GB and two cores. Memory matters more than cores: when it runs out, the site slows down or crashes, while an extra core without memory adds almost nothing. Below I show how to work out the memory for your site and how to see what it actually uses.
KVM or OpenVZ: which to chooseIn 2026 KVM is almost always the right pick: it costs a dollar or two more per month than OpenVZ, but everything runs on it, from Docker to Windows. OpenVZ makes sense in one narrow case, explained below, and at the end you will find the commands to check your own server in a minute.
NVMe or SSD: does it matter for a websiteFor a small site the difference between NVMe and SSD is barely noticeable, because pages are served from memory rather than from disk. It shows up in shops and sites with a large database. At the same host NVMe costs only about $0.50–1 a month more, and sometimes less, so what usually decides it is not the disk type but its size and how the host has limited it.
What is a VPS, in plain EnglishA VPS is a slice of a powerful physical server that you rent and that behaves like a separate computer, with its own operating system, its own IP address and full control. Below is how it differs from shared hosting, who needs one, what it costs and what to check right after you buy it.
VPS for a Telegram bot: what the bot needs and how to pick a planA bot with a menu and a few commands runs fine on the cheapest server, while a bot with broadcasts, files and a database hits completely different limits. Here is what a bot really consumes, which Telegram limits shape the choice of server and how to avoid overpaying.
How to test VPS ping and speed before you payThe numbers in a plan do not tell you the latency to your users or how fast the disk really is. Most of this can be measured before you pay, the rest in the first hour after launch. Here are the tools and how to read the results.
Corporate network on a VPS: remote access to the officeA rented server can become the hub of a company's private network: remote employees and branch offices connect through it to the ERP, file server, CRM and Git. Here are the common layouts, protocols, server requirements and security basics.
How to choose a VPS: the 7 specs that matterTwo plans with the same "2 cores, 4 GB, 50 GB" can differ several times in speed and twice in price a year later. Here is what stands behind each line of a VPS plan and what to check before you pay.
VPS vs VDS: is there a difference and what actually mattersIn most markets VPS and VDS mean the same thing: a virtual server. The difference that really affects your work is hidden not in the name but in the virtualization type and whether resources are guaranteed.