DDoS Protected Hosting: What to Check Before You Buy

Almost every host now advertises DDoS protection, but the phrase covers anything from a real filtering network to a policy of switching your server off.

The two can look identical on a pricing page. Both say "DDoS protected", both may quote a capacity in Tbps, and both are included for free. You only find out which one you bought on the day someone attacks you, which is the worst possible day to find out.

This guide explains what "DDoS protected hosting" can mean, the questions that tell real protection apart from a checkbox, the red flags in a hosting offer, and why changing hosts is often not the only way out.

What "DDoS protected hosting" can mean

Behind the label there are usually one of three things.

A null route with a better name. The host watches for floods, and when one hits your address it stops routing traffic to it. That protects the host's network and every other customer on it. It does not protect you: your server goes dark, which is exactly what the attacker wanted. We covered this in detail in null routing and DDoS attacks.

Generic volumetric filtering. The host or its upstream strips the obvious floods, such as amplified UDP and SYN floods, before they reach the datacenter. That is real protection, and for a website it is often enough. It is tuned for web traffic, though, and tends to struggle with anything else.

Filtering that understands your service. Traffic is checked against what your application really sends: the right protocol on the right port, the right packet shapes, sensible rates per player or client. Attack traffic that looks like a flood to a generic filter, and also traffic that does not, gets dropped while real users get through.

The first is common, the second is the minimum you should accept, and the third is what game servers and anything on UDP actually need.

Questions to ask before you buy

A host with real protection will answer these without hesitation. A vague answer is an answer too.

What happens when an attack is bigger than the protection?

Every network has a limit. What matters is what happens beyond it. Ask whether your address is null-routed, for how long, and whether you are told. "We will null-route the IP for 24 hours" is honest, and it tells you the protection ends where the attacks you are likely to see begin.

Is it always on, or switched on after an attack is detected?

On-demand protection waits until an attack is spotted, then diverts your traffic to be cleaned. The first seconds or minutes reach your server unfiltered. For a website that is a slow page. For a game server it is every player disconnected. See always-on vs on-demand DDoS protection for the trade-off.

Where does the filtering happen?

A filter is only useful if it sits in front of the link the attack fills. A box in the same datacenter, behind the same uplink, cannot help once that uplink is full. Ask whether filtering happens at the edge of the network, before traffic reaches your rack, and how much capacity sits there. Traffic scrubbing explains why location matters as much as size.

Does it understand UDP and game traffic?

Most protection was built for websites, which run on TCP and HTTP. Game servers, voice servers and VPNs run on UDP, where there is no handshake to check. A generic filter either lets a UDP flood through or drops real players along with it. Ask whether the host has rules for your specific game, and whether it handles Steam server queries without becoming a reflector. Our guide to game server DDoS protection goes deeper.

Can you see what it is doing?

If you cannot see attack traffic, what was dropped and why, you cannot tell an attack from a bug in your own server, and you cannot tell the host that its filter is dropping your players. Ask for a dashboard, not a promise.

What does an attack cost you?

Some providers bill mitigated traffic, charge for clean bandwidth above a base, or move you to a higher tier after repeated attacks. "Unmetered DDoS protection" sometimes has a ceiling in the terms of service. How DDoS protection pricing works breaks down what you are really paying for.

Does it add latency?

If clean traffic is routed through a scrubbing center far away, every player pays for it in ping. Ask where filtering happens relative to your users. Done close to them, it adds very little, as we explained in does DDoS protection add latency?

Is your real IP hidden?

Protection only works if attackers cannot go around it. If your server's own address leaks through an old DNS record, a mail header or a game's master server list, the protected address does not matter. See origin IP protection.

Red flags in a hosting offer

• A capacity number with nothing about what happens when an attack goes past it.
• "Protection included" with no dashboard, no logs and no settings.
• Mitigation that starts after you open a ticket.
• A null-routing policy hidden in the terms of an offer that promises protection.
• Game hosting sold on a network whose protection only mentions websites and HTTP.
• Every port and protocol treated the same, with no way to tell the filter what your server runs.

You do not have to change hosts

When a server keeps getting attacked, the usual advice is to move to a host that does better. That means a migration, downtime, new prices and often worse hardware for the money, and you still have to trust the new host's answers to the questions above.

The alternative is to keep the server you have and put protection in front of it. With a GRE tunnel, your users connect to a protected IP. Their traffic reaches a filtering network first, attacks are dropped there, and only clean traffic travels down the tunnel to your server. Your host, your hardware and your setup stay the same. Your host does not even need to offer protection, since nothing it sees is an attack anymore.

This is how Sterile works. You run one installer on your server, add a rule for each port with a profile for your game or protocol, and the filtering is always on, with a dashboard showing what was dropped. It works the same for a single VPS or dedicated server as for a fleet of them.

A short checklist

Before you buy DDoS protected hosting, or protection for the hosting you have, make sure you can answer yes to these:

• I know what happens when an attack exceeds the protection.
• Filtering is always on, not switched on after detection.
• It happens at the network edge, in front of the link an attack would fill.
• It understands my protocol and my game, not only websites.
• I can see what is being dropped.
• I know what an attack costs me.
• My server's real IP is not public.

Getting protected

If your current host fails that checklist, you have a choice: move, or protect what you already run. Server DDoS protection and game server DDoS protection explain how Sterile does it, and pricing shows what it costs before you commit to anything.