Published: 20 October 2026
From today, every server we sell comes with DDoS protection built in. Every KVM VPS, hourly or monthly, every streaming VPS and every dedicated server sits behind 100 Gbps of always on mitigation at layers 3 and 4, at no extra cost and with nothing to switch on. If a project draws bigger attacks, you can now move that one server to a higher tier, from 500 Gbps up to 10 Tbps with Layer 7 filtering. Here is what the included protection does, what each paid tier costs and how to choose.
What every server now includes
| Included protection | What you get |
|---|---|
| Mitigation capacity | 100 Gbps |
| Mode | Always on, no activation delay |
| Layers | L3/L4 (network and transport) |
| Attacks above 100 Gbps | 5 a month still mitigated |
| Price | Included, no setup fee |
Always on means your traffic passes through the filtering layer all the time. Mitigation starts with the first packets of an attack, not after a monitoring system notices the flood and reroutes your traffic, which is the gap that on demand services build in. Our guide to always on and on demand mitigation explains why those first minutes matter.
Layers 3 and 4 are where volumetric and protocol attacks live: UDP and ICMP floods, SYN floods, and amplification attacks that bounce DNS, NTP or memcached replies off open servers toward you. These are dropped before they reach your port, so your server never spends a CPU cycle on them.
Five bigger attacks a month, still covered
Most hosts that include DDoS protection set a ceiling and null route your IP the moment an attack crosses it. On our included tier, an attack larger than 100 Gbps is still mitigated, up to five times in the same month. An occasional outlier does not take you offline and does not force an upgrade.
From the sixth attack above 100 Gbps in the same month, the targeted IP is null routed until the attack stops, or until you move the server to a higher tier. We publish that rule because it is the first question anyone should ask a host. Our post on DDoS protected dedicated servers in Europe calls it the null route test, and explains how to put it to any provider on your shortlist.
Paid tiers, from 500 Gbps to 10 Tbps
| Mitigation capacity | Layers | Per server per month |
|---|---|---|
| 100 Gbps | L3/L4 | Included, plus 5 attacks a month above the cap |
| 500 Gbps | L3/L4 | €156.45 |
| 1 Tbps | L3/L4 | €523.95 |
| 2 Tbps | L3/L4 | €1,048.95 |
| 5 Tbps | L3/L4 | €2,623.95 |
| 10 Tbps | L3/L4 and Layer 7 | €4,723.95 |
Prices exclude VAT and apply per server. A tier sets the size of attack that one server absorbs. It does not change the port speed, the unmetered traffic or the price of the server itself, so the 1 Tbps tier costs the same on a €4 VPS as on a dedicated server with a 100 Gbps port. On an hourly VPS a paid tier is charged by the hour, like the server it protects.
Layer 7 is on the 10 Tbps tier
Application layer attacks work differently. An HTTP flood sends requests that look like real browsers asking for real pages, so a filter that inspects packets cannot tell them apart from your customers. The 10 Tbps tier adds filtering at that layer.
On every other tier, web apps that need Layer 7 cover should sit behind a CDN or a reverse proxy with a web application firewall, and the server should rate limit its expensive endpoints, such as login, search, checkout and API calls. Our guide to how DDoS protection works goes through the layers in more detail.
Which servers get it
| Service | From | DDoS protection |
|---|---|---|
| Hourly KVM VPS | €0.0056 an hour | 100 Gbps included |
| Monthly KVM VPS | €4 a month | 100 Gbps included |
| Streaming VPS on a 10 Gbps port | €9.99 a month | 100 Gbps included |
| Dedicated server, unmetered port | €209 a month | 100 Gbps included |
VPS prices are for Bucharest, and other VPS locations add a small fee shown at checkout. Dedicated servers cost the same in every country we serve. Servers you already run with us are covered as well, with no ticket to open and nothing to configure.
How to pick a tier
Size the tier to the attacks your workload actually draws, not to the biggest number on the page.
- Most servers: the included 100 Gbps. Websites, APIs, VPN endpoints, bots and most community game servers rarely see attacks above 100 Gbps, and the five covered attacks a month absorb the odd exception.
- Targeted often: 500 Gbps to 2 Tbps. Game networks, busy forums, VoIP and live streaming platforms that get hit again and again, where a null route means downtime that users notice.
- High profile targets: 5 or 10 Tbps. Services that draw multi terabit floods, or HTTP floods aimed at the application, which only the 10 Tbps tier filters.
A simple rule: start on the included tier and watch. If a server sees more than one or two attacks above 100 Gbps in a month, move it up a tier before a sixth one arrives.
How to add or change a tier
- When you order a VPS or a dedicated server, open the DDoS Protection option and pick a tier. The included 100 Gbps is preselected and costs nothing.
- For a server you already have, open it in the client area and change the DDoS Protection option in its upgrade options. On a monthly server you pay the difference for the rest of the billing period.
- To step back down later, change the option again. On a monthly server the unused part of the higher tier comes back as credit.
If you expect an attack on a known date, such as a launch or a tournament, raise the tier a day early and ask us by ticket to confirm it is active before the traffic arrives.
Questions we expect
Is DDoS protection really included with every VPS?
Yes. Every KVM VPS, hourly or monthly, every streaming VPS and every dedicated server includes 100 Gbps of always on protection at layers 3 and 4. The cheapest €4 plan gets the same filter as the largest dedicated server.
Does a higher tier make my server faster?
No. A tier is the size of attack it absorbs. Port speed and unmetered traffic stay exactly the same on every tier.
Is any tier on demand?
No. Every tier is always on, so there is no detection and rerouting delay when an attack starts.
What happens on the sixth big attack in a month?
On the included tier, the targeted IP is null routed until the attack stops, or until you move the server to a paid tier. Paid tiers raise the capacity for that server.
Full details and the order buttons are on our DDoS protection page. If you are new to the topic, start with what DDoS protection is and why your server needs it.