DDoS-Protected VPS Explained — What Filtering Actually Covers

What included L3/L4 DDoS filtering protects, what L7 attacks need, and how NovaVPS handles volumetric traffic on every VPS and dedicated plan.

نص المقال الطويل بالإنجليزية. الواجهة والكتالوج والدفع مترجمة.

The layers that matter

DDoS attacks are named by the OSI layer they hit. L3/L4 attacks (SYN floods, UDP amplification, ACK storms) try to saturate your pipe or state tables — these are absorbed upstream by the scrubbing centers before traffic reaches the host. L7 attacks (HTTP floods, slowloris, API hammering) look like real requests; no network filter can tell them from your users — they are your application's job (rate limiting, WAF, caching).

What is included on every plan

• VPS and Storage: automatic L3/L4 filtering, always on, no toggle and no extra fee.
• Dedicated: the same filtering, plus IPMI access so a compromised box can be reimaged out-of-band.
• Dual (top dedicated): L3/L7 scrubbing included.

Sizing against an attack

• Check the plan's port speed: unmetered 1–10 Gbps on VPS lines defines the clean traffic ceiling.
• Put stateful defenses in the app: connection limits, bot scoring, CDN in front of HTTP if the surface is web-only.
• Keep the attack surface small — a VPN endpoint or game server presents far less than a WordPress blog.