Hosting Guide

What DDoS Protection Actually Does

DDoS protection is frequently listed as a hosting feature. What it actually prevents, at what scale, and whether it's relevant for most sites are questions the feature list doesn't answer.

Overview

DDoS protection appears in the security features of budget shared hosting and enterprise cloud infrastructure alike. At the budget shared tier, it describes basic network-layer filtering. At the enterprise tier, it describes sophisticated mitigation capable of absorbing terabits of attack traffic. These are not the same thing advertised under the same name.

How to think about it

A DDoS (Distributed Denial of Service) attack sends enough traffic to a target to exhaust its capacity to respond to legitimate requests. The attack is distributed — it comes from many sources simultaneously, making simple IP blocking ineffective. The goal is availability disruption, not data theft or system compromise.

DDoS attacks are targeted. They are directed at specific sites or services for specific reasons: competition, activism, extortion, or retaliation. The vast majority of sites are not targets because they are not significant enough to be worth the resources an effective DDoS attack requires. A small business site, a portfolio, a blog — these are not DDoS targets.

What most sites do face is bot traffic — automated requests from scrapers, credential stuffers, and comment spammers. This is not DDoS; it is bot management. The mitigations are different. DDoS protection doesn't address bot traffic, and bot management doesn't address DDoS.

How it works

Network-layer DDoS protection filters traffic upstream of the hosting infrastructure. The provider's network detects anomalous traffic patterns, identifies attack traffic, and drops it before it reaches the server. This works against volumetric attacks that exploit network bandwidth — flooding the connection with more traffic than it can handle.

Application-layer DDoS protection (Layer 7) is more sophisticated. Attacks that mimic legitimate traffic can't be filtered by volume alone — they require behavioral analysis to distinguish attack requests from real ones. This is harder to implement and typically reserved for dedicated DDoS mitigation services rather than shared hosting security features.

The scale of protection matters. A hosting provider that can absorb 10Gbps of attack traffic and one that can absorb 1Tbps both advertise DDoS protection. The difference is only relevant when the attack exceeds the smaller capacity — which depends entirely on whether the site is a real target.

Where it breaks

Hosting-level DDoS protection fails against attacks that exceed the provider's network capacity. At the shared hosting tier, this capacity is much lower than dedicated DDoS mitigation services. A sophisticated attacker targeting a specific site can generate attack volumes that exceed what shared hosting infrastructure can absorb.

It also fails against application-layer attacks that look like legitimate traffic. A large number of requests to a computationally expensive page — a search with many results, a complex WooCommerce filter — can bring down a server without triggering volumetric DDoS detection. This is application-layer attack mitigation, not network-layer.

In context

Shared hosting DDoS protection: basic network-layer filtering. Adequate against automated bot traffic and small-scale attacks. Insufficient against targeted volumetric attacks.

CDN-based protection (Cloudflare free tier): network-layer DDoS mitigation with significantly higher capacity than shared hosting provides, combined with edge caching that reduces origin server exposure. More effective than hosting-level protection for most attack scenarios.

Dedicated DDoS mitigation: services designed specifically for high-value targets with persistent attack threat. This is the appropriate level for sites that actually face DDoS attacks — financial services, gaming, high-profile political content.