How to choose DDoS-protected hosting / VPS
“DDoS protection” is the most abused phrase in hosting marketing. Every $5 VPS claims it; few survive even a modest flood. Here is how to read through the marketing and pick infrastructure that stays online — and how to verify it before you move your project.
The three layers that matter
- L3/L4 volumetric capacity — measured in Tbps. Anything under ~1 Tbps of real filtering is a toy; large botnets push multiples of that. Anycast networks absorb floods close to their source instead of letting them reach your rack.
- L7 application filtering — measured in RPS. HTTP floods are cheap to launch and kill unprotected backends at tens of thousands of RPS. You want behavioural filtering, not just rate limits.
- SLA and humans — a protection system without 24/7 engineers behind it is an autoresponder. Look for named mitigation times in the SLA.
Questions to ask before paying
- What is the filtering capacity in Tbps (L4) and RPS (L7) — per client or shared?
- Is protection always-on or activated after detection? What is the mitigation time?
- What happens after the threshold — nullroute, rate limit, or scrubbing?
- Is there a test period or a way to verify protection with a real attack?
The only check that actually works
Take the candidate provider, deploy a test VPS, and attack it. Watch how fast mitigation kicks in, whether legitimate traffic survives, and how support behaves. Providers that are confident in their filtering allow (or at least tolerate) scheduled tests — treat “no tests allowed” as an answer in itself. Our testing guide has the full procedure.
Need firepower for the test? We provide free stress tests with up to 10+ Tbps L4 and 400M+ RPS L7 — enough to validate any protection claim on the market.