DDoS protection for hosting: what to check before buying
Compare network and application protection, traffic filtering and incident response before choosing DDoS protection for your server.
A distributed denial-of-service attack attempts to exhaust network or application resources and make a service unavailable. Protection aims to reduce the impact; no solution can promise immunity from every attack. The relevant question is which threats a particular service can detect and mitigate.
Distinguish network and transport attacks from application attacks. Traffic filtering for a server's IP address and a reverse proxy protecting HTTP requests solve different problems. A website, game server and mail service may therefore need different coverage. Check supported protocols and whether traffic must pass through a particular proxy or network.
Ask how protection is activated, what capacity and service limits apply, and how legitimate traffic is handled during filtering. Find out whether an address may be temporarily blocked, how alerts are delivered and which support channel handles incidents. An advertised filtering capacity alone does not explain expected availability.
Prepare your own incident response procedure. Monitor traffic, errors and application latency. Record the time and sequence of events, and configure appropriate request limits. When using a proxy, restrict direct access to the application server according to the proxy provider's instructions. After an incident, review blocked requests and adjust the rules to reduce incorrect blocking. Backups help restore data, but they do not stop a DDoS attack.