Quick answer
DDoS-protected hosting is server hosting where attack filtering is part of the network your machine sits on, rather than something you add in front of it afterwards. Traffic is filtered before it reaches your server, on every port, from the moment it boots. The practical appeal is that there is nothing to route, tunnel or configure — but the label is used loosely, so the useful question is always what specifically is filtered and up to what size.
How it differs from adding protection later
With a normal server you buy hosting first and protection second, then connect them — a reverse proxy for HTTP, or a GRE tunnel for anything else. It works and it keeps your existing hardware, but it is a second relationship and a second configuration to get right.
With protected hosting the machine is already inside the filtered network. Its address belongs to a range that is scrubbed by default, so there is no tunnel to build, no origin address to hide and no routing to maintain.
| Protected hosting | Protection added later | |
|---|---|---|
| Setup | None — it is on at boot | Tunnel or DNS change to configure |
| Coverage | Every port, all protocols | Depends on how it is connected |
| Origin exposure | No separate origin exists | Must be hidden and firewalled |
| Keeps existing hardware | No — you move | Yes |
| Vendors involved | One | Two |
What to check before buying
The phrase is marketed loosely enough that it means very little on its own. These questions separate real protection from a label:
- Which layers — packet filtering only, or application-layer protection too?
- Which ports — everything, or only 80 and 443?
- What capacity, and what happens to your traffic if an attack exceeds it?
- Is it always on, or activated after detection — and if the latter, how long does that take?
- Is it included in the price, or metered when an attack happens?
- Is UDP filtered? Many providers protect TCP well and simply null-route UDP under load, which is fatal for a game server.
Packet filtering is not application protection
Most hosting marketed as DDoS-protected means Layer 3/4 filtering: volumetric floods and protocol attacks are absorbed. That is genuinely valuable and it is what a game server needs.
It does nothing about application-layer attacks. A few thousand expensive HTTP requests per second will exhaust a web application while being far too little traffic to trigger any volumetric threshold. If you are hosting a website, protected hosting alone is not enough — you also want a WAF in front of it.
Who it suits
If your hardware is fine where it is, GRE transit gives you the same filtering without moving anything. Protected hosting is the better answer when you were going to rent a machine anyway.
- Game and voice servers, where UDP must keep flowing and no proxy can help
- Anyone who would otherwise run a tunnel and would rather not maintain one
- Services that were attacked at their previous host and need the problem gone rather than diagnosed
- Setups where hiding an origin address is impractical
Frequently asked questions
Last updated