What is DDoS-protected hosting?

02Always-on or on-demand

The second distinction is when filtering starts. Always-on filtering inspects traffic all the time. On-demand protection waits for an attack to be detected and then diverts traffic to a scrubbing service, often by changing routing.

Attack durations make the difference concrete. Cloudflare's DDoS report for the first half of 2026 found that 90.60% of network-layer attacks ended in under 10 minutes, and that even the largest hyper-volumetric attacks can be measured in seconds rather than minutes. A model that needs minutes to detect and divert can miss most attacks entirely, and still leaves you offline at the start of every one.

03The null-route problem

Some hosting sold as protected falls back to blackholing: when an attack gets large, the provider withdraws your address from the internet. The mechanism is a standard routing tool. RFC 7999 defines a well-known BLACKHOLE community, 65535:666, that asks neighbouring networks to drop all traffic to a prefix, and RFC 5635 describes remotely triggered blackhole filtering.

RFC 5635 is candid about the result: destination-based blackholing does complete the attack, in that the target becomes unreachable, while sparing the rest of the network. It is a sensible tool for an operator protecting everyone else. It is not protection for the customer whose address was dropped, which is why the BGP behaviour behind a provider's response matters when you compare offers.

04What to check before buying

The phrase is marketed loosely enough that it means very little on its own. Ports matter more than they used to: Cloudflare's then-record 29.7 Tbps attack in the third quarter of 2025 was a UDP carpet-bombing attack that hit an average of 15,000 destination ports per second, so protection limited to the web ports is no answer for a server. These questions separate real protection from a label.

05Packet filtering is not application protection

Most hosting marketed as DDoS-protected means Layer 3/4 filtering: volumetric floods and protocol attacks are absorbed. That is genuinely valuable and it is what a game server needs. The difference between the layers is covered in Layer 3/4 vs Layer 7 attacks.

It does nothing about application-layer attacks. A few thousand expensive HTTP requests per second will exhaust a web application while being far too little traffic to trigger any volumetric threshold. If you are hosting a website, protected hosting alone is not enough: you also want a WAF in front of it.

06Who it suits

If your hardware is fine where it is, routed protection over a tunnel gives you the same filtering without moving anything. Protected hosting is the better answer when you were going to rent a machine anyway.

• Game and voice servers, where UDP must keep flowing and no proxy can help; see DDoS protection for game servers
• Anyone who would otherwise run a tunnel and would rather not maintain one
• Services that were attacked at their previous host and need the problem gone rather than diagnosed
• Setups where hiding an origin address is impractical

07Testing a provider's claims

Marketing claims can be checked, but only within the law. Sending attack traffic at infrastructure without written permission is an offence in most jurisdictions, as explained in is DDoS illegal. Even a test against your own rented server crosses the provider's network and usually breaks its acceptable use policy unless they have agreed to it, so ask whether they permit and coordinate load tests. As the difference between a lawful load test and a booter shows, what makes a test legal is written authorisation and an agreed scope, not the tooling.

Short of a test, ask for evidence: graphs from real incidents, what customers saw during them, and whether addresses were null-routed. A provider that filters well usually has the data to show it.