Choosing a DDoS Mitigation Provider: Three Models, Compared

The right DDoS mitigation service depends on which of three delivery models you buy into: mitigation bundled into your hosting plan, a reverse-proxy CDN sitting in front of your origin, or a dedicated scrubbing provider using BGP diversion. None of these wins outright. Each trades off time to mitigate, cost during an actual attack, and how much legitimate traffic gets caught in the net. Pick based on your traffic profile and what downtime actually costs your business, not on whichever vendor quotes the biggest number.

What does a DDoS mitigation service actually do?

A DDoS mitigation service detects abnormal traffic aimed at knocking your site or application offline, then filters or absorbs it before it reaches your server. That might mean dropping malformed packets at the network layer, rate-limiting requests at the application layer, or rerouting your entire traffic path through a scrubbing centre mid-attack. The mechanism matters less than the outcome: does your site stay reachable, and does it stay reachable for real users rather than just for attackers who got blocked while a chunk of genuine visitors got blocked alongside them.

Most providers combine network-layer (L3/L4) filtering with application-layer (L7) protection, often delivered through a web application firewall. The gap between marketing copy and reality tends to show up at L7, where telling a bot flood apart from a genuine traffic spike takes more than counting volume.

What are the three ways to buy DDoS mitigation?

You are choosing between three fundamentally different architectures, and they are not interchangeable.

Bundled with your host. Most VPS and dedicated server providers include some network-layer protection as standard, usually enough to absorb small, opportunistic attacks. It's convenient and often free, but coverage tends to stop at L3/L4, with L7 protection sold as an upsell or missing entirely. If you're running anything beyond a brochure site, check exactly where the bundled tier stops before assuming you're covered. Our VPS hosting guide flags which providers disclose this clearly.

A reverse-proxy CDN in front of your origin. A CDN configured as a reverse proxy sits between the internet and your server, absorbing traffic at the edge before it reaches you. This is the most common route for websites and APIs because it's always-on by default, scales without you lifting a finger during an attack, and doubles as a performance layer. The catch: your origin IP has to stay hidden. Find it, and an attacker bypasses the proxy entirely and hits your server direct.

Dedicated scrubbing with BGP diversion. For large infrastructure, ISPs, or anyone facing volumetric attacks a CDN can't absorb, traffic gets rerouted through a specialist scrubbing centre via BGP announcements, cleaned, then sent on to your origin. This is the heaviest, most expensive option, and it's usually sold on-demand rather than always-on. That brings its own risk: on-demand means something has to detect the attack and trigger diversion first, and that detection window is where the damage happens.

Time to mitigate: the number that actually matters

Forget headline capacity figures for a moment. What decides your outcome is how long passes between an attack starting and your traffic running clean again. Always-on CDN protection tends to mitigate fastest because the filtering already sits in the traffic path, nothing needs triggering. On-demand scrubbing depends on detection thresholds, human or automated decisions, and how quickly BGP routes propagate, which is rarely instant. Ask any provider for their typical time to mitigate under real attack conditions, not a lab test, and be wary of anyone who dodges a straight answer.

Is L7 protection included or an expensive add-on?

Application-layer attacks, the kind that mimic real user behaviour to exhaust your server's resources rather than your bandwidth, are harder to stop and far more likely to hit small and mid-sized sites than a headline volumetric flood. Plenty of hosting plans advertise "DDoS protection" that covers only L3/L4, leaving L7 as a paid upgrade or nowhere to be found. If your business runs on a login form, a checkout, an API, or anything with application logic, confirm L7 coverage in writing before you sign, not after your first attack.

Always-on versus on-demand: what changes during an attack

Always-on protection filters every request, all the time, attack or no attack. It costs more as a baseline but removes the detection lag entirely. On-demand protection is cheaper day to day but only kicks in once an attack crosses a threshold, and the provider sets that threshold, not you. If your business can't tolerate even a short window while detection catches up, always-on is worth the premium. If your tolerance for brief disruption is higher, on-demand can be a reasonable trade.

Will legitimate traffic get blocked?

This is the part vendors talk about least and customers discover the hard way. Rules aggressive enough to stop attack traffic can just as easily flag genuine users, particularly anyone behind a VPN, a corporate proxy, or an unusual but legitimate browser fingerprint. Ask providers directly what their false-positive rate looks like in practice, how tunable the rules are, and whether you get visibility into what got blocked and why. A mitigation service that silently drops paying customers during a sale is arguably worse than a short outage, because you might not even notice it's happening.

What does the SLA actually pay out, and how is overage billed?

Read the SLA past the uptime percentage. What financial remedy do you get if mitigation fails or is slow, a meaningful credit or a token gesture against a fraction of your monthly fee? Then check the overage clause, because this is where bills spiral during a real attack. Plenty of "unlimited" mitigation plans cap the size or duration of attacks covered in the fine print, with anything beyond billed per gigabyte or per incident, a rate you often only discover once you're already under attack and reading the contract for the first time. Get this in writing before you need it, not during the incident.

Why "network capacity" figures are almost meaningless

Providers love quoting total network capacity in terabits per second as if it guarantees what your site specifically gets during an attack. It doesn't. That figure describes the provider's entire global network shared across every customer, not a dedicated slice reserved for you. Two customers under large-scale attack at the same time draw from the same pool. What actually matters is the capacity and mitigation logic applied to your traffic, your specific SLA terms, and whether the provider discloses real incident handling rather than aggregate marketing numbers. Cloudflare's own explainer on mitigation is a decent primer on how filtering actually works if you want the mechanics before comparing vendors. For background on attack types themselves, CISA's guidance on denial of service attacks is a useful, vendor-neutral starting point.

How do you shortlist providers without falling for the sales pitch?

Start with disclosure, not claims. Any provider worth signing with should tell you their typical time to mitigate, what counts as L7 versus L3/L4 coverage, and what happens to your bill during a large or prolonged attack. Use our hosting directory to see how different providers structure their security offerings, run a side-by-side with our comparison tool, and check our security section for hosts whose DDoS handling is documented rather than asserted. Our HostList Reliability Index also tracks how providers perform under real conditions rather than repeating their own marketing. If you're outsourcing infrastructure decisions entirely, our guide on how to choose a managed service provider covers the questions to ask about security responsibility in that relationship. And if your workload is latency-sensitive, our piece on game server hosting, latency, tick rate and DDoS walks through mitigation trade-offs specific to real-time traffic.

Frequently asked questions

Is DDoS mitigation included free with most hosting plans?

Basic network-layer filtering is often standard with VPS and dedicated hosting, but application-layer protection and higher-capacity mitigation are frequently sold separately. Always confirm what's genuinely bundled versus what needs an upgrade.

Do I need a dedicated scrubbing provider, or is a CDN enough?

For most websites, applications and small to mid-sized businesses, a properly configured reverse-proxy CDN with L7 protection is enough. Dedicated scrubbing with BGP diversion is generally reserved for large-scale infrastructure, ISPs, or organisations that have already been hit by volumetric attacks a CDN couldn't absorb.

Can DDoS mitigation block real customers by mistake?

Yes, and it happens more often than providers let on. Overly aggressive rules can flag VPN users, corporate networks and unusual but legitimate traffic patterns as attacks. Ask providers about their false-positive handling and whether you get visibility into blocked traffic.

What should I check in a DDoS mitigation SLA before signing?

Look past the uptime percentage to the actual financial remedy for failed or slow mitigation, and check how overage is billed if an attack exceeds the plan's covered size or duration. These details, not the headline capacity figure, determine what an attack actually costs you.