Is Layer 4 protection enough for a website?

No. It will absorb volumetric floods, but application-layer attacks — expensive queries, credential stuffing, scraping — arrive as normal-looking HTTPS at ordinary rates and pass straight through a packet filter.

Can Layer 7 protection secure a game server?

Not usefully. Game traffic is typically UDP and has no HTTP for the proxy to read. Game servers need packet-level filtering, generally over a GRE tunnel.

Do I need a separate provider for each?

You should not. Running both on one platform means one panel, one bill and one set of policies, rather than two vendors pointing at each other during an incident.

Learning centre

Network & delivery

6 min readUpdated Jul 2026

Layer 3/4 vs Layer 7 protection: what is the difference?

Quick answer

Layer 3/4 protection works on packets: it sees addresses, ports and traffic volume, and can filter any protocol including UDP, but it cannot read what a request means. Layer 7 protection terminates the HTTP connection and inspects the full request, so it can identify an exploit or a bot but only works for web traffic. Which you need follows directly from what you are protecting — a website is a Layer 7 problem, a game server is a Layer 3/4 problem, and many businesses have both.

What the layers mean

The numbers come from the OSI model, which describes networking as a stack. Layer 3 is the network layer, where IP addresses live and routing decisions are made. Layer 4 is the transport layer — TCP and UDP, ports, and the notion of a connection. Layer 7 is the application layer, where protocols like HTTP live and a request has a method, a path and headers.

Protection at a given layer can only reason about what that layer exposes. A Layer 3/4 filter can see that an address is sending 400,000 packets a second to port 443 and act on it. It cannot see that the request is `POST /login` with a stolen password, because at that layer the payload is opaque bytes.

Layer 3/4 filtering sees packets; Layer 7 sees the request. Each stops attacks the other cannot.

Side by side

	Layer 3/4	Layer 7
Sees	Addresses, ports, packet rates	Method, path, headers, body, client
Protocols	Any — TCP, UDP, ICMP, custom	HTTP and HTTPS only
Stops	Volumetric and protocol floods	Exploits, bots, credential stuffing, scraping
Delivery	Routing / GRE tunnel	DNS change to a reverse proxy
Typical for	Game servers, mail, VPN, custom services	Websites, shops, APIs
Can challenge clients	No — packets cannot be asked questions	Yes — a browser can solve a check

Which one do you need?

If the thing you are protecting is reached by a browser or an HTTP client — a website, a shop, an API — Layer 7 protection is both necessary and sufficient. You point DNS at a reverse proxy and it inspects everything.

If it is reached by anything else — a game client on a UDP port, a mail server on 25, a VPN endpoint, a custom binary protocol — Layer 7 cannot help, because there is no HTTP to inspect. You need packet-level filtering in front of the machine, usually delivered over a GRE tunnel so your server's real address never appears in public routing.

Many businesses need both, and they compose cleanly: the website runs through the HTTP proxy while the game or voice servers run through filtered transit.

How Layer 3/4 protection is delivered

Because packets cannot simply be pointed somewhere with a DNS record, Layer 3/4 protection changes routing instead. The usual mechanism is a GRE tunnel: a virtual point-to-point link between the scrubbing network and your server.

Traffic for your protected addresses arrives at the provider, is filtered there, and the clean remainder is encapsulated and delivered to your machine through the tunnel. Your server replies either through the tunnel or directly, depending on the setup. Either way, the address the world sees belongs to the provider, and your real address stays hidden.

Frequently asked questions

Last updated 24 July 2026