Published: 21 October 2026
A VPS is the cheapest way to put something on the internet, and the easiest thing to knock off it. A game server, a VPN endpoint, a Discord bot or a small forum only has to annoy the wrong person, and attacks are cheap to buy. Every X-Zone KVM VPS now sits behind 100 Gbps of always on DDoS protection, from the €4 plan up, at no extra cost. This guide covers what that protection does on a VPS, what it leaves to you, and how to set up a small server so it stays reachable when someone aims at it.
Why a small VPS goes down in an attack
A VPS shares a physical host, and the uplink in front of it, with other customers. An attack does not need to beat your server. It only needs to fill the link before your traffic gets there. A flood of a few gigabits is already larger than any single VPS can take, and without filtering upstream the usual answer from a host is to null route your address so the other customers on the node stay online.
That is why DDoS protection only works when it sits in the network, before the traffic reaches the host. Ours does. Floods are dropped in front of the node, so neither your VPS nor its neighbours ever see them, and the size of your plan makes no difference to how big an attack it survives. VPS I with 2 GB of RAM gets the same 100 Gbps filter as VPS VI with 32 GB.
What a DDoS protected VPS should mean
Plenty of hosts print "DDoS protection" on a VPS plan and stop there. Four answers tell you whether it means anything. Here are ours.
| Question to ask | Our answer |
|---|---|
| How big an attack is filtered? | 100 Gbps included, up to 10 Tbps on paid tiers |
| Is it always on? | Yes, filtering runs all the time, with no activation delay |
| Which layers? | Layers 3 and 4, plus Layer 7 on the 10 Tbps tier |
| What happens above the cap? | 5 bigger attacks a month are still mitigated, then the targeted IP is null routed until the attack stops or you upgrade |
| What does it cost? | Nothing for the included 100 Gbps |
If a provider cannot answer the fourth question in writing, assume the answer is a null route at the first big attack. Our overview of the new DDoS tiers has the full rules and prices.
KVM VPS plans with DDoS protection
| Plan | vCPU | RAM | SSD | Per month | Per hour |
|---|---|---|---|---|---|
| VPS I | 1 | 2 GB | 20 GB | €4 | €0.0056 |
| VPS II | 2 | 4 GB | 40 GB | €6 | €0.0083 |
| VPS III | 2 | 8 GB | 60 GB | €10 | €0.0139 |
| VPS IV | 4 | 16 GB | 80 GB | €16 | €0.0222 |
| VPS V | 6 | 24 GB | 100 GB | €30 | €0.0417 |
| VPS VI | 8 | 32 GB | 120 GB | €58 | €0.0806 |
Prices are for Bucharest and exclude VAT. Other VPS locations add a small monthly fee, shown at checkout. Every plan is a full KVM virtual machine with root access, unmetered traffic, one IPv4 address and the included 100 Gbps of DDoS protection. You can pay monthly or by the hour, and our post on what a €4 KVM VPS should buy explains what to expect from the entry plan.
What the network filter leaves to you
Network level protection stops floods. It does not fix everything that can take a service down, and it helps to know where the line is.
- HTTP floods. Requests that look like real visitors pass a packet filter. Below the 10 Tbps tier, put a website behind a CDN or a reverse proxy with a web application firewall.
- Expensive requests. One slow search or login endpoint can be hammered by a few hundred clients. Rate limit it in the web server or the app.
- Login attempts. Password guessing on SSH or a control panel is not a DDoS, and the filter will not block it. Use SSH keys and a tool such as fail2ban.
- A leaked origin. If your site sits behind a CDN but the VPS address shows up in old DNS records or mail headers, attackers go around the CDN. Allow ports 80 and 443 only from the CDN's addresses.
Five habits that keep a small VPS reachable
- Close every port you do not use. A firewall that allows only SSH and your service leaves an attacker fewer targets and keeps reflected junk off your applications.
- Keep admin access on a second address. An extra IPv4 costs €1.50 a month. Put SSH and your panels on it, keep it out of DNS, and you can still log in while the public address is under attack.
- Hide websites behind a proxy. Point the domain at the proxy, never at the VPS, and firewall the web ports to the proxy only.
- Rate limit what costs you CPU. Logins, searches, API calls and anything that queries the database.
- Watch from outside. A probe in another country tells you when users cannot reach you, even when the server itself looks healthy. Our guide to uptime probes from five countries shows a cheap way to set that up.
When a VPS needs more than 100 Gbps
Most never do. The included tier plus five covered bigger attacks a month is enough for nearly every website, bot and community server. If a VPS keeps drawing attacks above 100 Gbps, you have two routes. You can raise the tier for that VPS alone, from €156.45 a month for 500 Gbps, or by the hour on an hourly VPS. Or, if the project has grown to the point where it is a regular target, it has probably outgrown a VPS anyway, and a dedicated server with its own guaranteed port is the next step. Both get the same included protection.
How to order
- Pick a plan on the VPS hosting page, or on the hourly VPS page if you want to pay by the hour.
- Choose a location. Pick the one closest to your users.
- Leave the DDoS Protection option on the included 100 Gbps, or choose a higher tier.
- Pick an operating system and pay. The VPS is usually online in about a minute, already behind the filter.
Not sure whether to pay monthly or hourly? Our guide to hourly VPS billing walks through the maths.