DDoS protection for servers and VPS: yours and your host's part

The general picture of layered defence is on DDoS protection.

Hosting offered as DDoS protected usually means the provider filters floods upstream of your server, up to some size and for some attack types. Below that size, traffic is cleaned; above it, many providers blackhole the address, which takes the server offline to protect their other customers.

Ask the provider what the threshold is, which families are filtered, whether filtering is always on, and what happens when the limit is passed. Those answers matter more than the label on the plan.

On shared hosting, many sites share one server and one address. An attack on a neighbour can take your site down with it, and the host is likely to protect the server as a whole rather than your site. Moving the site behind an edge network is the most effective step you can take on your own.

A VPS shares a physical machine but has its own address, so floods against it are yours alone, and so is the decision to hide it. A dedicated server adds control over the network card and kernel settings, but the link in front of it is still the limit; the provider's upstream filtering matters as much as on any other plan.

A website served through an edge network or CDN is reached at the network's addresses, not the server's. If the server's own address stays private, attackers have to go through the network; if it leaks, they can flood the server directly. Bridge CDN is the network this site belongs to.

• Accept web traffic only from the edge network. Refuse direct connections on ports 80 and 443.
• Check old DNS records. Historical records and subdomains often still point at the server.
• Watch what the server sends out. Email headers and outbound requests can reveal its address.
• Change the address if it has leaked. Protection that can be bypassed is not protection.

1. Close what you do not use. Every open port is something to flood; a firewall that allows only needed services removes them.
2. Keep management off the public internet. SSH and admin panels behind a VPN or an address allowlist; see IP blocking.
3. Turn on SYN cookies. They keep a SYN flood from filling the connection table.
4. Set timeouts for slow clients. Short header and body timeouts blunt Slowloris-style attacks.
5. Limit requests per client. On the web server or in front of it, for expensive paths first.

None of these raises the size of the link. They make the server last longer against small attacks and fail less badly against larger ones.

1. Contact the host first. Only they can filter what fills your link.
2. Check whether the origin address is the target. If the attack bypasses your edge network, the address has leaked.
3. Tighten request limits on the targeted paths, and note each change so it can be undone.
4. Move the site behind an edge network if it is not already, and change the server's address.

Detection and response in more detail are on DDoS mitigation.