How to test your hosting’s DDoS protection

Almost every hosting provider’s landing page says “DDoS protection included”. In practice that can mean anything from a real anycast scrubbing network to “we nullroute you for 24 hours and call it mitigation”. The only way to know what you actually pay for is to attack yourself — in a controlled way.

Step 1. Get a baseline

Before any test, record normal behaviour: response times from several regions (check-host.net works fine), CPU/bandwidth graphs, and your provider’s nullroute threshold if documented. You need a “before” picture to compare against.

Step 2. Run a controlled attack

Start with Layer 4 (UDP/TCP floods) and then Layer 7 (HTTP GET/POST floods) — they stress completely different defences. A provider can survive 100 Gbps of UDP and still fold at 50K RPS of HTTP. Ramp up gradually and agree the test window with your hoster if required by their ToS. Don’t have attack capacity? That is exactly what our free stress test is for.

Step 3. Measure what matters

• Mitigation time — how long from attack start to filtered traffic. Good: under a minute. Bad: “we nullrouted you”.
• False positives — did legitimate users survive? Protection that blocks everyone is just self-DoS with extra steps.
• L4 vs L7 asymmetry — many filters stop volumetrics but let HTTP floods through.
• Support reaction — did anyone notice and respond, or did monitoring sleep through it?

What good protection looks like

Anycast distribution, dedicated scrubbing capacity measured in Tbps, an L7 layer that actually inspects HTTP behaviour, and an SLA that names concrete mitigation times. If the marketing page has none of these words, assume there is nothing behind it — and if you are shopping for a new place, see our guide on choosing DDoS-protected hosting.

Want numbers instead of promises? Request a free stress test — we will show you exactly where your setup breaks, with graphs.