Published: 26 October 2026
Almost every host now says DDoS protection is included. The phrase hides very different products. Some providers publish a capacity figure and some do not, some filter all the time and some wait until an attack is detected, and only a few tell you in writing what happens to your IP when an attack is bigger than their filter. We read the official pages of six popular providers and set them next to our own offer, so you can see what each one actually promises. Provider details were checked on their own sites and documentation on 20 October 2026.
The five questions that matter
- Is it included, or sold as an extra? And on which products.
- What capacity is stated? A number you can hold the provider to, or nothing.
- Which layers? Layers 3 and 4 cover floods. Layer 7 covers HTTP floods that look like real visitors.
- Always on, or on detection? Filtering that runs all the time starts with the first packet. Detection based systems reroute traffic after they notice an attack.
- What happens above the limit? The answer is often a null route, also called a blackhole, which takes your address offline to protect the network.
Our guide to always on and on demand mitigation explains the fourth question in depth, and our post on DDoS protected dedicated servers covers the fifth.
DDoS protection compared
| Provider | Included | Stated capacity | Layers | Paid upgrade | Above the limit |
|---|---|---|---|---|---|
| OVHcloud | Yes, on every product | Attacks up to 1.3 Tbit/s handled, over 17 Tbit/s of global filtering capacity | L3/L4, plus game filtering on game bare metal | None listed | Not stated, no traffic limits applied |
| Hetzner | Yes, free for all customers | Not stated | Not stated on its DDoS page | None | Not stated |
| Contabo | Yes, free on all servers | Not stated | Not stated | None | Some attacks cannot be mitigated, no guarantee |
| Vultr | Optional extra | 10 Gbps per instance | L3/L4 | $10 per instance per month | Not stated |
| netcup | Yes, free | 2 Tbps on root and managed servers, no figure on VPS | Up to L4 | None | Not stated |
| DigitalOcean | Yes, free | Not stated | L3/L4, no L7 | None | Email to the owner, IP blackholed until traffic drops |
| X-Zone Servers | Yes, on every VPS and dedicated server | 100 Gbps included, up to 10 Tbps | L3/L4, plus Layer 7 at 10 Tbps | Five tiers, €156.45 to €4,723.95 per server per month | 5 bigger attacks a month mitigated, then null route until the attack stops or you upgrade |
OVHcloud
OVHcloud builds its Anti-DDoS system into the price of every product, with no extra charge whatever the size of the attack. Its own pages cite attacks of up to 1.3 Tbit/s handled and more than 17 Tbit/s of filtering capacity worldwide, one of the largest figures any host publishes. Detection runs all the time, and traffic goes through the scrubbing system when an attack is detected. The protection cannot be switched off. Layer 7 filtering exists as Game DDoS Protection, but only on OVHcloud's game bare metal servers, and the company says it is not available on its VPS range. Our X-Zone vs OVHcloud comparison covers the rest of the two offers.
Hetzner
Hetzner offers free DDoS protection to all customers and describes the hardware behind it, but does not publish a capacity figure, the layers covered or a policy for very large attacks. In March 2026 Hetzner announced that it had deployed Nokia Deepfield Defender across its European data centres, filtering at the network edge and sending complex application layer attacks to a separate scrubbing system. That is a real upgrade, though it still comes without a published number. See our X-Zone vs Hetzner comparison.
Contabo
Contabo includes free DDoS protection on all servers and web hosting, and describes its Cloud VPS protection as always on. It publishes no capacity figure or layer coverage, and its help centre says plainly that it cannot guarantee every attack will be stopped, since some are too large or too unusual to mitigate. Our X-Zone vs Contabo comparison has the full picture.
Vultr
Vultr sells DDoS protection as an option you add to an instance, at deploy time or later, for $10 per instance per month. It covers 10 Gbps of attack traffic at layers 3 and 4. Traffic is rerouted for filtering once an attack is detected, generally within about 60 seconds according to Vultr's documentation. Larger capacity was listed as coming soon in its older documentation. What happens to an instance without the option, or above 10 Gbps, is not stated. See our X-Zone vs Vultr comparison.
netcup
netcup includes DDoS protection at no charge and stresses that it is standard, not an extra. For root and managed servers it states a 2 Tbps filter covering attacks up to and including layer 4, switched on automatically when unusual traffic arrives. Its VPS page lists DDoS protection without a figure. Our X-Zone vs netcup comparison covers the rest.
DigitalOcean
DigitalOcean includes free, always on DDoS protection at layers 3 and 4 on Droplets, Kubernetes, managed databases and load balancers, and its documentation says plainly that there is no layer 7 protection. It is also one of the few providers that documents what happens above its limit: the account owner gets an email and incoming traffic to the address is blackholed until the attack drops back below capacity. There is no paid tier to raise that limit. See our X-Zone vs DigitalOcean comparison.
What we offer
Every KVM VPS, streaming VPS and dedicated server we sell includes 100 Gbps of always on DDoS mitigation at layers 3 and 4. Five attacks a month above 100 Gbps are still mitigated. From the sixth in the same month, the targeted IP is null routed until the attack stops, or until you move the server up a tier.
| Mitigation capacity | Layers | Per server per month |
|---|---|---|
| 100 Gbps | L3/L4 | Included |
| 500 Gbps | L3/L4 | €156.45 |
| 1 Tbps | L3/L4 | €523.95 |
| 2 Tbps | L3/L4 | €1,048.95 |
| 5 Tbps | L3/L4 | €2,623.95 |
| 10 Tbps | L3/L4 and Layer 7 | €4,723.95 |
On an hourly VPS the paid tiers are billed by the hour, so you can raise protection just for a launch or a tournament. Ports and traffic stay unmetered on every tier.
Which one fits your project
- You want the biggest network behind you and need nothing above layer 4: OVHcloud publishes the largest figures, and its protection is included everywhere.
- You run a cheap VPS and rarely get attacked: almost every provider here includes enough. Check the fifth question anyway.
- You need a number in writing, and a way to buy more when you need it: that is what we built. A stated 100 Gbps on every server, a published rule for bigger attacks, and paid tiers up to 10 Tbps with Layer 7 on a single server.
- You need Layer 7 filtering on a web app: few hosts state it for ordinary web traffic. With us it comes with the 10 Tbps tier. On any other plan, at any host, put a CDN or a web application firewall in front.
Whatever you choose, ask the provider the five questions above and get the answers in writing. Our guide to our DDoS tiers has every detail of our own answers, and the DDoS protection page has the order buttons.