A DDoS-protected server is one hosted on network infrastructure that filters attack traffic before it reaches your machine — but a good share of the "DDoS protected" labels on the market do not mean real protection at all; they mean your IP gets null-routed the moment an attack starts. The difference between those two is the difference between your service staying up during an attack and going completely dark. This guide covers how protection actually works, the attack types, the right questions to ask a provider, and why game servers need a different approach.
The scale of attacks has changed fundamentally over the past two years. According to Cloudflare's H1 2026 report, 23.2 million network-layer attacks were mitigated in six months — an average of roughly 5,300 attacks per hour. In Q2 alone, 805 attacks exceeded 1 Tbps, a 519% quarter-over-quarter increase.
The largest attack on record was a 31.4 Tbps flood mitigated in November 2025, and it lasted just 35 seconds. That duration is no accident: 90.6% of attacks end in under 10 minutes.
Taken together, those two figures mean one thing: protection cannot depend on human intervention. By the time you open a ticket and wait for a reply, the attack is over and your server has already been down. Protection has to engage automatically, within seconds.
A DDoS (Distributed Denial of Service) attack sends traffic from many sources at once to make a service unusable. The goal is not to break into the system but to keep it so busy it cannot serve legitimate users.
Attacks fall roughly into three groups:
Aimed at filling the link. Most network-layer attacks live here: UDP floods at 56%, SYN floods at 17%, TCP floods at 10%, ACK floods at 8% and ICMP around 6%. DNS-based attacks also came to the fore in 2026, accounting for 34.3% of network-layer attacks.
Target not bandwidth but the state tables of firewalls and load balancers. They can cause large impact with relatively little traffic.
Exhaust the application with requests that look legitimate. The hardest type to distinguish — volumetric filtering does not help here.
Three very different practices hide behind the same phrase:
When an attack is detected, the provider discards all traffic to your IP. The infrastructure is protected; you are not. Your service is completely unreachable for the duration. The outcome is exactly what the attacker wanted.
Traffic passes through a scrubbing centre, attack packets are stripped out, and legitimate traffic keeps reaching your server. Your service stays up during the attack.
Protects HTTP/HTTPS traffic. Effective for websites, but insufficient for game servers, voice servers or anything on custom ports — those services do not sit behind the proxy.
"How many Gbps of protection?" is the wrong question, because a capacity figure alone says nothing about what is protected. The right questions are:
With written answers to those four, the real meaning of "200 Tbps" versus "10 Gbps" between two providers also becomes clear. We covered how to read capacity figures in what DDoS protection capacity actually means.
Gaming absorbs roughly 19% of DDoS attacks. The motivation is not only financial: in competitive games and roleplay communities, knocking a rival server offline is used directly as a way to win players.
Technically, the critical detail is this: game traffic runs largely over UDP. Standard web protection — proxy-based CDNs included — is designed for HTTP/HTTPS and does not cover game ports. A game server therefore needs network-level protection that includes UDP. We covered this in does Cloudflare protect game servers.
A second detail: attack frequency is high on infrastructure hosting game servers. For an attack on a neighbouring customer not to reach you, resources must be isolated — on shared resources, a neighbour's attack shows up in your TPS.
The need is not uniform across services. Roughly in priority order:
And if you resell what you host — reseller hosting or game server rental — protection is no longer only about your continuity but your customers' as well.
Scrubbing-based protection works in roughly three stages:
The critical measure here is that third step: if the system stops the attack but also locks out legitimate users, the outcome is not far from a null route. It is worth asking a provider what happens in the case of false positives.
Network-level protection stops volumetric attacks, but your server's own configuration is part of the defence:
If you have just taken delivery of a server, follow our first 10 steps to secure a new VDS for the basic hardening.
Since most attacks end within minutes, the real work happens beforehand. Still, when one hits:
Nubitro provides 200 Tbps+ DDoS protection as standard across the infrastructure, covering every server product — web hosting, VDS, game servers and voice servers. Servers run in Istanbul, Turkey on AMD Ryzen 9 9950X processors with NVMe M.2 SSD storage and 1 Gbps unmetered traffic.
Because resources are assigned through hardware partitioning, load hitting a neighbouring customer does not show up in your performance — in a DDoS context, that design decision matters as much as the protection itself.
Browse the products on our Ryzen VDS, FiveM server and dedicated server pages, or see everything on the Nubitro homepage.
It stops most volumetric attacks at the network level. Application-layer (L7) attacks resemble legitimate requests and need additional measures: rate limiting, caching and challenge mechanisms. Protection is one layer; configuration is the other.
Because it makes your service unreachable — exactly what the attacker wanted. The provider's infrastructure is protected; your service is not. Real protection means legitimate traffic keeps flowing.
It can be effective for your website. But if you run a game server, a voice server or anything on a custom port, that protection does not cover those ports. You need network-level protection that includes UDP.
If a scrubbing infrastructure is working, yes: filtering can add some latency. If it becomes completely unreachable, you have probably been null-routed, or the bottleneck is your own server.
A significant share of attacks is carried out by automated tools with no target selection. And on game and community servers, the motivation is often personal rather than commercial. Being small guarantees nothing.
Both models exist. What matters is not price but scope: which layer, does it include UDP, does it engage automatically. A paid solution that null-routes is worse than an included one that scrubs.
Turkey (Türkçe)
Worldwide (English)
