DDoS Protection
Cloudflare DDoS Protection detects and mitigates distributed denial-of-service attacks automatically, at the edge of one of the world's largest networks — without capping the size of the attack it will absorb.
Overview
A distributed denial-of-service (DDoS) attack tries to knock a website, API or entire network offline by flooding it with traffic from thousands of compromised devices. Attacks range from massive volumetric floods at the network layer (L3/4) to stealthy application-layer (L7) request floods that exhaust a web server with what looks like legitimate traffic.
Cloudflare's DDoS protection is always on and unmetered: mitigation starts automatically, usually within seconds, and there is no surcharge based on attack size or frequency. Because filtering happens at the Cloudflare data centre closest to the attack source, malicious traffic is dropped before it ever reaches your origin infrastructure or consumes your bandwidth.
Key capabilities
- Unmetered mitigation of L3, L4 and L7 attacks on every plan — no attack-size caps or overage fees
- Autonomous edge detection that typically begins mitigating within seconds, with no ticket or phone call required
- Anycast network spanning 300+ cities with capacity measured in the hundreds of terabits per second — far larger than the biggest attacks ever recorded
- Managed DDoS rulesets for HTTP floods, with per-zone sensitivity and override controls
- Protection for websites, APIs, and (with Spectrum) arbitrary TCP/UDP applications such as game servers and VoIP
- Magic Transit extends the same protection to entire public IP prefixes and on-premise networks (Enterprise)
- Adaptive protection that learns your traffic profile and flags deviations from it
- Real-time attack analytics, alerting, and post-incident reports in the dashboard and via API
How it works
Cloudflare operates an anycast network: every data centre announces the same IP prefixes, so each attacking device is routed to the Cloudflare location nearest to it. A distributed attack is therefore automatically split across hundreds of sites and absorbed in parallel, instead of converging on a single scrubbing centre. This is the architectural reason the network can shrug off multi-terabit floods.
At each edge location, detection systems sample packets and HTTP requests and compare them against known attack fingerprints and against the normal profile of your traffic. When a flood is identified, a mitigation rule is generated and pushed to the data path within seconds — dropping the malicious traffic in kernel-level packet filters (for L3/4) or challenging and blocking abusive requests (for L7) while legitimate users pass through.
Because your origin sits behind Cloudflare (or, with Magic Transit, behind Cloudflare-announced BGP routes), attackers never learn your real infrastructure addresses, which removes the most common way targeted attacks bypass a CDN.
Plans & licensing
Unmetered DDoS protection for websites and applications is included on all Cloudflare plans — Free, Pro, Business and Enterprise. Advanced capabilities differ by plan: Enterprise adds Advanced DDoS features such as richer analytics, adaptive protection tuning, and a dedicated response team, while Magic Transit (network-layer protection for your own IP ranges) and Spectrum for arbitrary TCP/UDP ports are Enterprise products.
Plan entitlements are accurate as of 2026 and subject to change — confirm the current packaging with us before you commit to an architecture.
Deployment with Integrity
As a certified Cloudflare partner for Central and Eastern Europe, Integrity delivers this product end to end — including a free pilot so you see results on your own traffic before committing. A typical rollout:
- Assessment. We review your exposure: public hostnames, APIs, network prefixes, past incidents, and what an hour of downtime costs you.
- Free pilot. We onboard a representative zone onto Cloudflare in a proof-of-concept, usually without changing your hosting, and validate mitigation behaviour against your traffic.
- Configuration. DNS is moved (or Magic Transit BGP is set up), origin IPs are rotated and locked down so traffic can only arrive via Cloudflare, and DDoS rule sensitivity is tuned.
- Testing and tuning. We verify legitimate traffic patterns — including your monitoring, payment callbacks and partner integrations — are never challenged, and adjust overrides.
- Runbooks and alerting. Attack notifications are wired into your channels and an incident runbook is agreed with your team.
- Handover or managed service. Your team takes over with our documentation, or Integrity operates the setup for you under an SLA.
Ready to start? Contact us to arrange the free pilot.
FAQ
Will Cloudflare charge us more if we get hit by a huge attack?
No. DDoS mitigation is unmetered on every plan: neither attack size nor attack frequency changes your bill. You pay for the plan and add-ons you chose, not for the attacks you receive.
Can attackers just bypass Cloudflare and hit our origin directly?
Only if your origin IP is discoverable or unfiltered. During deployment we rotate origin addresses and restrict origin firewalls to Cloudflare's published IP ranges (or use Cloudflare Tunnel), which closes this gap.
We run non-web services — a game server and a mail server. Are those covered?
Standard zone protection covers HTTP/HTTPS. Non-web TCP/UDP services can be protected with Spectrum, and entire networks including mail infrastructure with Magic Transit; both are Enterprise-level products we can scope with you.