What a DDoS attack does to an unprotected server
A distributed denial-of-service attack floods a server or network with traffic from many sources at once. The goal is simple: exhaust bandwidth, overwhelm connection tables or tie up application resources so real visitors cannot get through. Attacks are cheap to launch and target everything from small forums to large stores. On an unprotected network, the usual response is to null-route the targeted IP address, which ends the attack by taking you offline.
Types of attacks protection must handle
- Volumetric attacks that saturate network links with sheer traffic volume, often using amplification through misconfigured internet services.
- Protocol attacks that abuse how connections are established, exhausting firewalls, load balancers or the server's own network stack.
- Application-layer attacks that send requests that look legitimate, such as repeated page loads, searches or login attempts, to overload the web application.
Good hosting protection handles the first two at the network edge. The third often needs cooperation between the host's filtering, a web application firewall and your own configuration.
Ways providers deliver protection
In-network mitigation
The provider filters traffic on its own network before it reaches your server. This is the most common form for hosting, VPS and dedicated servers and usually requires no configuration from you.
Upstream scrubbing
Traffic is routed through scrubbing centers with large capacity, then clean traffic is forwarded to the data center. It suits very large attacks but can add some latency depending on geography.
Proxy and CDN protection
For websites, a reverse proxy or CDN in front of the server absorbs attacks and hides the origin IP. It works well for HTTP traffic but does not cover other protocols such as game or mail traffic.
How to compare DDoS-protected hosting
- Is protection always on or triggered after detection?
- Which locations and IP ranges are covered?
- Are there limits on attack size or duration before null routing applies?
- Is application-layer filtering included, or only network-level?
- Can you see attack notifications and logs?
- Does legitimate traffic still count toward bandwidth allowances during an attack?
Choosing the right server type
Protected shared hosting suits websites that simply need to stay online. A protected VPS fits APIs, communities and custom applications. Protected dedicated servers suit large platforms and game networks that need both full hardware and strong filtering. Use the filters above to switch between them.
Beyond the provider's filters
Protection works best as part of a wider plan: keep origin IPs private where possible, rate limit expensive endpoints, cache aggressively, close unused ports, and keep off-server backups. Compare the monthly price and the renewal price with protection included, and use the money-back guarantee to verify latency.
For details specific to virtual servers, read DDoS protection for VPS. Multiplayer communities should see DDoS protection for game servers.
