DDoS protection services: how to compare them
A DDoS protection service absorbs and filters attack traffic before it reaches your website, application or network. The main choices are always-on cloud protection (traffic always flows through the provider's network) or on-demand scrubbing (traffic is rerouted only during an attack). For websites and APIs, always-on protection on a large edge network such as Cloudflare's is the common choice.
Types of DDoS attack a service must stop
- Network and transport floods (layer 3 and 4): UDP, SYN and reflection attacks that fill your bandwidth.
- Application floods (layer 7): huge numbers of real-looking HTTP requests that exhaust servers and databases.
- Low-and-slow attacks that hold connections open to tie up resources.
Always-on versus on-demand
Always-on services keep your traffic flowing through the provider all the time, so attacks are filtered in seconds and there is nothing to switch over. On-demand services reroute traffic only after an attack is detected, which suits some network setups but leaves a gap at the start of an attack.
Questions to ask a DDoS protection provider
- Is mitigation unmetered, or are you billed for attack traffic?
- Does it cover layer 7 attacks on your website and API, not just network floods?
- Who tunes the rules and responds during an attack, and how fast?
- What reporting do you get during and after an attack?
- Does the same service include a WAF, bot management and caching?
Managed DDoS protection from Vigilbase
Vigilbase runs DDoS protection on Cloudflare's global network as part of Vigilbase Shield, together with a managed WAF and bot protection. Vigilbase is a Preferred Cloudflare Partner, and its team configures protection from day one and changes it during attacks, with follow-the-sun support around the clock.
Frequently asked questions
How much do DDoS protection services cost?
It ranges from free plans for small sites to enterprise contracts. Compare whether attack traffic is billed, whether layer 7 protection is included, and whether anyone operates it for you.
Can a small business be hit by a DDoS attack?
Yes. Attacks are cheap to rent and often aimed at online shops, gaming, finance and anyone a competitor or extortionist wants offline.
Does a CDN protect against DDoS?
A large CDN absorbs many network floods. Application attacks still need WAF rules and rate limits tuned to your site.