What is DDoS Protection?
Absorbs and filters floods of junk traffic aimed at knocking a website, API, or network offline, so legitimate visitors keep getting through even while an attacker is trying to overwhelm the connection.
By Cyber Tool Stack Editorial TeamReviewed
Verified Sources: cloudflare.com, developers.cloudflare.com, cisa.gov
The lesson
Surviving a flood of a million fake visitors
Attackers can rent tens of thousands of hijacked devices and aim them all at one website at once. This lesson explains how sites stay online while under that flood.
If it helps, think of it as… the rent-a-mob outside the shop
Imagine a rival pays a huge crowd to jam a shop's doorway — nobody in the mob wants to buy anything, they just stand there so real customers can't get in. DDoS protection moves the entrance into a stadium-sized lobby with thousands of staff who wave genuine customers through and turn the mob away before it ever reaches the shop door.
Traffic arrives
Real visitors mixed with a botnet flood
Absorb
Global network with huge spare capacity
Filter
Tell genuine requests from junk
Clean traffic
Reaches the real servers
Flood dropped
Junk absorbed at the edge
What it does
A distributed denial-of-service (DDoS) attack doesn't break into anything. It overwhelms: thousands or millions of devices send junk traffic at one target until the servers, or the network connection in front of them, can't serve real visitors anymore. The "distributed" part is what makes it hard to stop — the traffic comes from everywhere at once, usually from a botnet, a swarm of hacked computers, routers, and cameras that an attacker controls remotely.
DDoS protection keeps a website, API, or network reachable during that flood. The core idea is capacity plus filtering: route incoming traffic through a global network with far more bandwidth than any attack can fill, identify the junk, and forward only legitimate requests to the real servers behind it.
The attack it stops
DDoS attacks come in a few flavors, and protection has to handle all of them. Volumetric attacks are brute force: fill the target's internet connection with garbage data so nothing else fits through. Protocol attacks exploit how networking itself works — for example, starting thousands of half-finished connections that tie up a server's memory until it can accept no more. Application-layer attacks are sneakier: they send what look like normal web requests, but millions of them, forcing the server to do expensive work for fake visitors until it collapses.
Motives vary — extortion notes demanding payment to stop, cover for a quieter intrusion happening at the same time, activism, or plain sabotage. Because botnets can be rented cheaply by the hour, even small organizations get hit.
How it works, step by step
- Traffic is steered through the protection service — either continuously (always-on) or activated when an attack begins — by changing DNS records or network routing announcements.
- The service's global network absorbs the flood, spreading it across many data centers with enormous spare capacity so no single link saturates.
- Filtering separates real from fake: known attack patterns, requests that don't behave like real browsers, impossible request rates from single sources, and challenges that automated bots fail.
- Clean traffic is forwarded to the real servers, which never see the flood. Modern services detect and start mitigating automatically within seconds, without waiting for a human to notice.
What it doesn't do
DDoS protection keeps you reachable; it doesn't keep you unbreached. An attack that overwhelms is entirely different from one that infiltrates — flood defenses won't stop phishing, stolen passwords, or an exploited web vulnerability. Application-layer floods that closely imitate real user behavior remain the hardest to filter. And a mitigation service only defends traffic that actually routes through it: if the address of the server behind it leaks, attackers can flood that server directly.
The beginner misconception is that a DDoS "hacks" a website. It doesn't — nothing is stolen and nothing is infected. It's a blockade, and the damage is downtime, lost revenue, and a distracted security team.
How it fits the stack
DDoS protection is usually delivered alongside a WAF, which inspects the content of the requests that flood filtering lets through. An on-premises firewall can absorb only small attacks, because its internet link fills up long before a cloud network would. And network detection helps determine whether a flood is a smokescreen for a quieter intrusion attempt happening at the same time.
The field guide
Evaluating this category
A second pass for buyers: market context, distinctions that matter, and what to weigh when tools in this category start looking alike.
Any service reachable from the public internet is reachable by anyone — including someone who wants it offline. A distributed denial-of-service attack doesn't need to break in; it just needs to send more traffic, or more resource-hungry requests, than the target can handle, so legitimate visitors can't get through the flood. Renting enough compromised devices or cloud capacity to generate that flood is cheap and easy, which is why the attacks are common against anything with a public footprint.
The defense works by scale: routing traffic through a network built with far more absorption capacity than the flood, filtering out the junk, and passing legitimate requests through to the real destination — ideally before a visitor notices anything happened at all.
The problem it solves
A website, API, or network link is sized for realistic peak legitimate demand, not for an attacker deliberately trying to exceed it. Once incoming traffic outstrips available bandwidth or server capacity, everyone suffers — real customers get timeouts and failures right alongside the flood, with no way for the target to tell the difference on its own.
Attacks increasingly target the application layer rather than raw bandwidth: instead of a brute packet flood, they send seemingly valid requests designed to exhaust servers or application logic. Such attacks can down a service with far less bandwidth than a volumetric flood, and are harder to distinguish from a real, if unusually large, spike in legitimate use.
How it works
During an attack, traffic destined for the protected service gets redirected — via a BGP route announcement or a DNS change — through a provider's scrubbing network instead of going straight to the origin. That network is built with far more absorption capacity than any single customer would ever provision on their own, spread across many points of presence so an attack against one customer doesn't have to be absorbed at a single location.
Volumetric mitigation filters out floods aimed at simply saturating available bandwidth, while application-layer protection inspects requests that look superficially legitimate but are actually part of an attack pattern targeting the application itself rather than the network link. Clean, legitimate traffic is forwarded on to the real origin; the flood is dropped at the scrubbing layer and never reaches it.
Always-on vs on-demand mitigation
Always-on protection routes all traffic through the scrubbing network permanently, so mitigation is already active the instant an attack begins, at the cost of adding a small amount of latency to every request, all the time, whether under attack or not.
On-demand protection normally lets traffic flow directly to the origin, only rerouting through scrubbing once an attack is detected — avoiding that constant latency cost, but introducing a detection-and-failover window at the start of an attack during which some disruption is possible before mitigation kicks in fully.
Choosing one
Start with how much an outage would actually cost: a revenue-critical service or one with strict uptime commitments usually justifies the always-on approach despite the added latency, while a lower-stakes service may accept a brief on-demand failover window in exchange for better everyday performance and lower cost.
From there, weigh the kind of attacks most likely to matter — pure volumetric floods versus more targeted application-layer attacks — against the provider's stated scrubbing capacity and, importantly, how quickly it actually detects and mitigates an attack in practice, since a huge network that reacts slowly still lets a fast, targeted attack do damage before protection engages.
Capability taxonomy
What buyers typically evaluate when comparing tools in this category.
- Volumetric attack mitigation
- Absorbs and scrubs massive traffic floods aimed at saturating bandwidth.
- Application-layer (L7) protection
- Filters attacks targeting web apps and APIs rather than just raw bandwidth.
- Always-on or on-demand mitigation
- Offers continuously active protection or activation only when an attack is detected.
- Global scrubbing capacity
- Total network capacity available to absorb attack traffic before it reaches you.
- BGP/DNS-based redirection
- Reroutes traffic through scrubbing centers via BGP announcement or DNS during an attack.
- Automatic mitigation speed
- How quickly the service detects and starts mitigating an attack without manual action.
Tools in this category
Now that you know what DDoS Protection does, see who does it.
4 tools