Published: 23 October 2026
A live stream is the easiest thing on the internet to ruin. A website that goes down for ten minutes loses some visitors. A stream that goes down for ten minutes in the middle of a match, a launch or a Sunday service loses the moment, and the audience rarely comes back for the rest. That makes stream servers a favourite target, and it is why every streaming VPS we sell now sits behind 100 Gbps of always on DDoS protection at no extra cost. This guide covers how attacks hit a stream, how to lay out a streaming VPS so they miss, and when a higher tier is worth it.
Where an attack hits a stream
A self hosted stream has two sides. On the ingest side, your encoder pushes one stream to the server. On the delivery side, the server sends copies to viewers, either directly or through a platform or CDN. Both sides depend on one public address, and an attacker who learns it only needs to fill the port in front of it.
- A flood at the port. UDP, SYN or amplification traffic that fills the link before your stream gets through. Viewers see buffering, then nothing.
- A flood at the ingest. If the encoder's path to the server is jammed, the stream drops even though delivery still works.
- A null route. The worst outcome on an unprotected host, where the provider stops announcing your address to protect its other customers. The stream is gone until the penalty runs out.
The included protection deals with the first and the third. Floods are dropped in the network before they reach the 10 Gbps port, so the port stays free for real traffic, and your address keeps being announced while the attack fits inside the tier.
Streaming VPS plans with DDoS protection
| Plan | vCPU | RAM | SSD | Sustained throughput | Per month |
|---|---|---|---|---|---|
| Streaming VPS I | 1 | 2 GB | 20 GB | about 1 to 2 Gbps | €9.99 |
| Streaming VPS II | 2 | 4 GB | 40 GB | about 2 to 3 Gbps | €18.99 |
| Streaming VPS III | 4 | 8 GB | 60 GB | about 3 to 4 Gbps | €34.99 |
| Streaming VPS IV | 6 | 16 GB | 80 GB | about 4 to 5 Gbps | €59.99 |
| Streaming VPS V | 8 | 24 GB | 100 GB | about 5 to 6 Gbps | €89.99 |
| Streaming VPS VI | 12 | 32 GB | 120 GB | about 5 to 6 Gbps | €139.99 |
Prices are for Bucharest and exclude VAT, and other locations add a fee shown at checkout. Every plan runs on a shared 10 Gbps port with unmetered traffic, and the throughput column is the estimated minimum each plan sustains, with bursts able to use the full port. Our article on what a 10 Gbps streaming port really gets you explains the numbers.
The DDoS filter capacity has nothing to do with those throughput figures. A 100 Gbps attack is ten times the size of the port itself. That is exactly why the filter has to sit upstream, in the network, rather than on the server.
Lay out the server so attacks miss
- Split ingest and delivery addresses. An extra IPv4 costs €1.50 a month. Use one address for your encoder to push to and keep it out of DNS, player pages and chat. Publish only the delivery address. Attackers aim at the address they can see.
- Allow the encoder only. Firewall the ingest port so that only your encoder's address, or your studio's range, can connect. Everyone else gets dropped before the streaming software sees a packet.
- Close everything else. A streaming VPS needs SSH, the ingest port and the delivery ports. Nothing more should be reachable.
- Restream when the audience is big. If you send the stream on to YouTube or Twitch, the platform carries the viewers and absorbs attacks on its side. Your server only has to keep the ingest and the restream alive.
- Keep a second server ready for big events. A second streaming VPS in another city, with the encoder able to switch to it, turns an outage into a short blip. Our guide to running a 24/7 live stream from a VPS covers that setup.
When a stream needs a higher tier
The included tier also covers five attacks a month above 100 Gbps. From the sixth in the same month, the targeted address is null routed until the attack stops or the server moves up a tier. For most channels, events and church streams that is plenty. A platform that is attacked again and again, where every outage is visible to thousands of viewers, should look at the paid tiers.
| Setup | Per month |
|---|---|
| Streaming VPS III, included 100 Gbps protection | €34.99 |
| Streaming VPS III with 500 Gbps protection | €191.44 |
| Streaming VPS V with 1 Tbps protection | €613.94 |
The tiers are priced per server and do not change port speed or traffic. Our guide to the DDoS tiers lists all six, up to 10 Tbps with Layer 7.
When to move to a dedicated server
A streaming VPS shares its 10 Gbps port fairly with other customers. Once one origin has to feed thousands of viewers directly, a dedicated server with a guaranteed, unshared port is the better tool, from €659 a month at 10 Gbps, with the same 100 Gbps of DDoS protection included. Our post on how many viewers a dedicated server can stream to shows where that line falls for each bitrate.
How to order
- Pick a plan on the streaming VPS page and a location close to your viewers or your platform's ingest.
- Add a second IPv4 address for ingest.
- Leave DDoS protection on the included 100 Gbps, or choose a higher tier.
- Pick an operating system and pay. The server is usually online in about a minute.
For bitrates, codecs and sizing, read our guide to the best VPS for streaming.