Cloud vs on-premise DDoS protection: which solution fits

DDoS mitigation solutions come in four classes: cloud-based DDoS protection that scrubs traffic in a provider's network, on-premise appliances in your own data centre, filtering by the network provider that carries your traffic, and edge networks that serve your site from many locations. They differ less in quality than in where they sit, and where a measure sits decides what it can stop.

Section DDoS protection Updated 8 Oct 2026 Compares four solution classes

Quick facts

Cloud scrubbing: Traffic is diverted to a provider's network, cleaned and forwarded
On-premise appliance: A device in your network inspects traffic after it arrives on your link
Network provider: The carrier filters or blackholes upstream of your link
Edge network: Your site is served from many locations, so floods are spread out
Deciding question: Can the solution act before your own link is full?

This page compares classes of solution, not vendors. Rankings age quickly; the questions below do not.

Four kinds of DDoS mitigation solution compared

Class	Where it sits	Stops floods that fill your link	Sees application requests	Main cost
Cloud scrubbing	Provider's network, upstream	Yes	Partly, if it terminates HTTPS	Diversion delay, or always-on fees
On-premise appliance	Your network, after the link	No	Yes, with keys	Hardware, staff, link size limits
Network provider	Upstream carrier	Yes, often bluntly	No	Coarse measures such as blackholing
Edge network	In front of the origin, many locations	Yes, by spreading load	Yes	Origin must be hidden behind it

No class covers everything. Most sites combine one that acts upstream with one that sees requests.

Cloud-based DDoS protection

A cloud scrubbing service has capacity no single site could buy. Traffic reaches it either always, through DNS or routing, or on demand, when an attack is detected and routes are changed. On demand is cheaper and slower: the minutes between detection and diversion are minutes of outage.

For application attacks the service has to read requests, which means terminating HTTPS with your certificate. Decide whether you accept that before the attack, not during it.

On-premise DDoS appliances

An appliance in your data centre sees everything that reaches you, with full context, and reacts quickly to protocol and application attacks. It cannot help when the flood is larger than the link in front of it, because the packets are dropped before the appliance sees them.

That limit is physical rather than a matter of product quality; RFC 4732 discusses why resource exhaustion upstream cannot be fixed downstream. Appliances are usually paired with upstream filtering.

// four classes, and the attack families each one reaches

Questions to ask a DDoS protection provider

Which attack families does it cover? Volumetric, protocol, application, or a subset.
Is it always on or on demand? If on demand, how long from detection to diversion.
Does it need your TLS keys? And where are requests decrypted.
What do you see during an attack? Logs of what was refused, and whether you can observe before enforcing.
How is the origin protected from direct traffic? If the origin's address is known, attackers go around the service.
What happens to legitimate traffic? How false positives are found and reversed.

Choosing between cloud and on-premise

If your link can be filled, you need something upstream: cloud scrubbing, an edge network or your provider. If your attacks are mostly at layer 7, you need something that reads requests, close to the application. For a website, an edge network with request filtering often covers both; for a data centre with many services, upstream scrubbing plus an appliance is common.

Whatever you choose, the preparation on DDoS protection and the response steps on DDoS mitigation still apply.

Questions

What is cloud-based DDoS protection?

Cloud-based DDoS protection diverts traffic to a provider's network, removes attack traffic there, and forwards the rest to you, so floods are absorbed before they reach your link.

Is on-premise DDoS protection enough?

Not against floods larger than your link, because traffic is dropped before an on-premise device sees it. It is usually combined with upstream filtering.

What should I ask a DDoS mitigation provider?

Which attack families it covers, whether it is always on, whether it needs your TLS keys, what you see during an attack, how the origin is protected, and how false positives are handled.