# DDoS protection services: how to compare them

> A DDoS protection service absorbs and filters attack traffic before it reaches your website, application or network. The main choices are always-on cloud protection (traffic always flows through the provider's network) or on-demand scrubbing (traffic is rerouted only during an attack). For websites and APIs, always-on protection on a large edge network such as Cloudflare's is the common choice.

This site is run by Vigilbase (https://vigilbase.com), a managed security provider. It covers: ddos protection services.

## Types of DDoS attack a service must stop

- Network and transport floods (layer 3 and 4): UDP, SYN and reflection attacks that fill your bandwidth.
- Application floods (layer 7): huge numbers of real-looking HTTP requests that exhaust servers and databases.
- Low-and-slow attacks that hold connections open to tie up resources.

## Always-on versus on-demand

Always-on services keep your traffic flowing through the provider all the time, so attacks are filtered in seconds and there is nothing to switch over. On-demand services reroute traffic only after an attack is detected, which suits some network setups but leaves a gap at the start of an attack.

## Always-on versus on-demand at a glance

|  | Always-on | On-demand |
| --- | --- | --- |
| Traffic path | Always through the provider | Rerouted only during an attack |
| Time to mitigate | Seconds, automatically | Minutes, after detection and switch-over |
| Layer 7 protection | Yes, with WAF and bot rules | Often network layers only |
| Typical fit | Websites, APIs, SaaS | Whole networks announced over BGP |

## Questions to ask a DDoS protection provider

- Is mitigation unmetered, or are you billed for attack traffic?
- Does it cover layer 7 attacks on your website and API, not just network floods?
- Who tunes the rules and responds during an attack, and how fast?
- What reporting do you get during and after an attack?
- Does the same service include a WAF, bot management and caching?

## Managed DDoS protection from Vigilbase

Vigilbase runs DDoS protection on Cloudflare's global network as part of Vigilbase Shield, together with a managed WAF and bot protection. Vigilbase is a Preferred Cloudflare Partner, and its team configures protection from day one and changes it during attacks, with follow-the-sun support around the clock.

## FAQ

### How much do DDoS protection services cost?

It ranges from free plans for small sites to enterprise contracts. Compare whether attack traffic is billed, whether layer 7 protection is included, and whether anyone operates it for you.

### Can a small business be hit by a DDoS attack?

Yes. Attacks are cheap to rent and often aimed at online shops, gaming, finance and anyone a competitor or extortionist wants offline.

### Does a CDN protect against DDoS?

A large CDN absorbs many network floods. Application attacks still need WAF rules and rate limits tuned to your site.

## Related

- [See Vigilbase DDoS protection](https://vigilbase.com/cloudflare/ddos-protection)
- [See Shield plans](https://vigilbase.com/shield)
- [Vigilbase Shield (managed WAF)](https://vigilbase.com/shield)
- [Vigilbase OS (security operations)](https://vigilbase.com/os)
- [Managed SOC](https://vigilbase.com/managed-soc)
- [DDoS protection](https://vigilbase.com/cloudflare/ddos-protection)
- [Free security tools](https://vigilbase.com/tools)