Network-level DDoS protection for every cloud server
DDoS Shield is the network-level DDoS protection of the data-centre network, covering the public IPv4 of every cloud server in every location. On by default, no setup, no extra fee.
- Large network floods are handled in the data-centre network, before they reach your server
- On for every cloud server in every location, at no extra cost
How DDoS Shield works
Traffic to your server's public IPv4 address passes through the DDoS protection of the data-centre network first — automatically, for every server, with nothing for you to turn on or configure.
- 01
Internet
Every connection to your server's public IPv4 address, including attack traffic.
- 02
Data-centre network protection
The data-centre network's DDoS protection deals with large network floods before they reach your server.
- 03
Your cloud server
Normal traffic reaches your server. Filtering your application traffic stays with your own firewall.
- 04
Report what gets through
If an attack still affects your server, report it from the console and our team looks into it with the network operator.
There is no configuration step — DDoS Shield covers your server as soon as it has a public IPv4 address.
DDoS protection features
Always on for every server
Every cloud server is covered from the moment it gets a public IPv4 address — no activation step, no activation fee.
Every location
DDoS Shield covers cloud servers in every location we offer, not just some of them.
No extra fee
It is included with every cloud server. There is no separate tier or add-on to buy.
Aimed at large network floods
It is built to stop large network floods that would otherwise overwhelm your server's connection.
Not a firewall or WAF
It does not inspect or filter your application traffic, so keep a firewall on your server and use a web application firewall if you need one.
Help when you need it
Report an attack that gets through, or ask us to null-route an address for a while, right from the console.
DDoS Shield in your console
The DDoS Shield page in the console has three parts. It shows no attack charts or event logs.
Your public IP addresses
A list of your servers' public IPv4 addresses with their server and region, each marked as protected.
Report an attack
Tell us which address is affected and what you see. Our team looks into it with the network operator and replies on the request page and by email.
Request a null-route
Ask us to drop all traffic to one of your addresses for 1 to 720 hours, for example to stop an attack from affecting your other services.
Protected VM vs unprotected VM
| An unprotected VM | A VM on this platform | |
|---|---|---|
| Default protection | You arrange your own DDoS protection | Already on for every server, nothing to set up |
| Large network floods | Can fill your server's connection and take it offline | Handled by the data-centre network's DDoS protection before they reach your server |
| Application traffic | Filtered by your own firewall or WAF | The same: DDoS Shield is not a firewall or WAF, so keep yours |
| If an attack gets through | You contact your provider however you can | Report it from the console, or request a null-route for the address |
| Cost | Often a separately priced DDoS protection service | Included with every cloud server, no extra charge |
DDoS protection pricing: included with your VM
DDoS Shield is included with every cloud server at no extra charge — there is nothing separate to buy or activate.
If you need help during an attack, the console lets you report it or request a null-route for an address.
There is no separate DDoS Shield tier to upgrade to — every cloud server gets the same network-level protection, as part of the plan you already pay for.
DDoS protection FAQ
Launch a cloud server with DDoS Shield included
DDoS Shield covers your server the moment it gets a public IPv4 address — nothing to configure, nothing extra to pay.