Most hosting directories list DDoS protection as a binary feature: a host either has it or lacks it. In production, that label tells you almost nothing without a specific mitigation figure. Entry-level protection tiers often absorb only two to three gigabits per second before upstream routers null-route your IP address to protect their own switches. When modern botnets generate tens or hundreds of gigabits per second, an uninspected checkbox gives a false sense of security.
Baseline capacity versus volumetric attack scale
Many baseline hosting plans include rudimentary packet filtering designed for small traffic spikes. That works for basic port floods, but modern volumetric attacks easily exceed 100 Gbps, and coordinated assaults regularly push past 1 Tbps. When an incoming attack exceeds your host's mitigation ceiling, the provider typically drops all incoming traffic to your IP address (blackholing). Your server stays powered on, but visitors cannot reach it.
Evaluating protection requires verifying four technical details:
-
Mitigation capacity: Baseline tiers typically cap between 2 Gbps and 10 Gbps. Dedicated scrubbing networks absorb multiple terabits across distributed points of presence.
-
Filtering activation: Always-on filtering inspects and cleans incoming packets continuously. Reactive systems monitor traffic thresholds and route packets through scrubbing filters only after detecting an anomaly, leaving a brief exposure window during sudden spikes.
-
Protocol layer coverage: Standard hosting covers network and transport layers (Layer 3 and Layer 4), such as SYN floods and UDP amplification. Application-layer attacks (Layer 7), like HTTP request floods that mimic authentic browser traffic, require reverse proxy inspection and web application firewalls.
-
Bandwidth billing: Some hosts charge overage fees for attack traffic routed through scrubbing centers. Unmetered mitigation absorbs legitimate and illegitimate spikes without variable billing.
Mitigation architectures by provider
-
Cloudways: Routes traffic through Cloudflare's enterprise edge network. Mitigation covers Layers 3, 4, and 7 without bandwidth caps on attack traffic. Plans start around $11 per month on top of cloud compute instances (DigitalOcean, AWS, Google Cloud, or Vultr). This fits teams wanting application-layer filtering without configuring reverse proxies manually.
-
Liquid Web: Includes baseline DDoS protection on standard VPS nodes starting around $5 per month, with filtering capacity in the single-digit Gbps range. They sell dedicated scrubbing upgrades for higher-risk gaming or e-commerce deployments where baseline limits fall short.
-
Vultr: Treats expanded DDoS filtering as an optional add-on at $10 per month per instance across most locations. Enabling it routes traffic through dedicated appliances that add roughly 10 Gbps of hardware-level mitigation. If you deploy Vultr or boutique hosts in Southeastern carrier hotels, check our facility review on Atlanta VPS Hosting in 2026.
-
Hostinger: Uses Corero and Wanguard appliances to provide automatic Layer 3 and 4 filtering across budget VPS tiers. It handles routine script-kiddie traffic, though sustained large-scale attacks exceed its entry-tier infrastructure.
-
OVHcloud: Operates its own proprietary Anti-DDoS scrubbing infrastructure (VAC) directly across its global backbone. Protection is automatic, unmetered, and built into all VPS tiers without add-on charges.
A DDoS protection checkbox means nothing without knowing the exact gigabit threshold where the provider null-routes your IP.
Shayan Ali
What to verify before ordering
Ask the host's sales or support engineering team these specific questions before provisioning:
-
What is the maximum mitigation capacity in Gbps or Tbps before traffic is null-routed?
-
Is traffic routed through scrubbing centers continuously, or does filtering activate on detection?
-
Does the base plan include Layer 7 inspection, or does it cover only Layer 3 and 4 floods?
-
Are mitigation bandwidth spikes metered, and what are the overage rates during an active incident?
If you are pairing high-capacity scrubbing with European privacy jurisdictions, read our guide on Best Offshore VPS Hosting in 2026 to see how overseas routing impacts network latency during active packet inspection. For high-volume transit nodes peered directly at major European internet exchanges, see our analysis on Frankfurt VPS Hosting in 2026.
Frequently asked questions
Q: Does a personal blog or small portfolio need dedicated DDoS protection? A: Routine websites rarely attract targeted volumetric attacks. Standard provider filtering usually suffices unless your site handles financial transactions, hosts competitive game servers, or touches politically sensitive topics.
Q: What mitigation capacity is sufficient for typical production sites? A: For small to mid-sized web services, always-on protection between 10 Gbps and 20 Gbps handles common automated sweeps. Sites in high-risk categories should look for multi-hundred Gbps or Tbps-scale edge networks.
Q: Why does Layer 7 protection cost more? A: Inspecting HTTP request headers, TLS handshakes, and application payloads requires significantly more CPU compute than dropping malformed UDP packets at the border router.
Q: What happens when an attack exceeds my plan's capacity? A: The data center issues a BGP null-route to discard all incoming traffic before it hits the facility's internal switches. The attack ceases to strain the host, but your site remains inaccessible until the flood subsides.
If you are reviewing network architecture or weighing mitigation capacity for a specific workload, feel free to reach out.
