DDoS Protection

For infrastructure that attracts attacks, Cloudflare’s DDoS protection is the single biggest reason to sleep well at night. It’s unmetered on every plan — you don’t get a surprise bill or a null-route because someone pointed a booter at you — and mitigation is automatic at both L3/4 and L7.

The managed DDoS rulesets have sensible defaults and are tunable when they misfire, and the attack analytics are good enough to actually understand what hit you after the fact.

Multi-hundred-gigabit attacks get absorbed without a single alert firing on the customer side. That’s the product working exactly as advertised, and the industry pricing model it broke (paying per attack, or per Gbps of protection) deserved to die.