Buyer's guide
DDoS protection services: how to compare them
A DDoS protection service absorbs and filters attack traffic before it reaches your website, application or network. The main choices are always-on cloud protection (traffic always flows through the provider's network) or on-demand scrubbing (traffic is rerouted only during an attack). For websites and APIs, always-on protection on a large edge network such as Cloudflare's is the common choice.
- ISO 27001 compliant
- SOC 2 Type 2 compliant
- Preferred Cloudflare Partner
- 24/7 follow-the-sun support
Types of DDoS attack a service must stop
- Network and transport floods (layer 3 and 4): UDP, SYN and reflection attacks that fill your bandwidth.
- Application floods (layer 7): huge numbers of real-looking HTTP requests that exhaust servers and databases.
- Low-and-slow attacks that hold connections open to tie up resources.
Always-on versus on-demand
Always-on services keep your traffic flowing through the provider all the time, so attacks are filtered in seconds and there is nothing to switch over. On-demand services reroute traffic only after an attack is detected, which suits some network setups but leaves a gap at the start of an attack.
Always-on versus on-demand at a glance
| Always-on | On-demand | |
|---|---|---|
| Traffic path | Always through the provider | Rerouted only during an attack |
| Time to mitigate | Seconds, automatically | Minutes, after detection and switch-over |
| Layer 7 protection | Yes, with WAF and bot rules | Often network layers only |
| Typical fit | Websites, APIs, SaaS | Whole networks announced over BGP |
Questions to ask a DDoS protection provider
- Is mitigation unmetered, or are you billed for attack traffic?
- Does it cover layer 7 attacks on your website and API, not just network floods?
- Who tunes the rules and responds during an attack, and how fast?
- What reporting do you get during and after an attack?
- Does the same service include a WAF, bot management and caching?
Managed DDoS protection from Vigilbase
Vigilbase runs DDoS protection on Cloudflare's global network as part of Vigilbase Shield, together with a managed WAF and bot protection. Vigilbase is a Preferred Cloudflare Partner, and its team configures protection from day one and changes it during attacks, with follow-the-sun support around the clock.
How Vigilbase helps
Vigilbase runs security operations and website protection for businesses that would rather not build a security team.
Vigilbase Shield
Managed Cloudflare WAF, DDoS and bot protection, configured and watched by our team.
Learn moreVigilbase OS
AI investigates every alert and brings you only verified threats, with the fix ready to approve.
Learn moreManaged SOC
A security team watching your environment around the clock, without hiring one.
Learn moreFrequently asked questions
How much do DDoS protection services cost?
It ranges from free plans for small sites to enterprise contracts. Compare whether attack traffic is billed, whether layer 7 protection is included, and whether anyone operates it for you.
Can a small business be hit by a DDoS attack?
Yes. Attacks are cheap to rent and often aimed at online shops, gaming, finance and anyone a competitor or extortionist wants offline.
Does a CDN protect against DDoS?
A large CDN absorbs many network floods. Application attacks still need WAF rules and rate limits tuned to your site.
More free tools and guides
Security handled, around the clock
Vigilbase is ISO 27001 and SOC 2 Type 2 compliant and a Preferred Cloudflare Partner, with follow-the-sun support from teams in Kenya, South Africa, the UAE and Portugal.