VPS and DDoS protection: what each provider includes, compared

A well-designed control panel won't keep a server online during a DDoS attack. For anyone running a public API, game server or e-commerce platform, the question you should ask before choosing a VPS isn't how convenient the panel is, but where malicious traffic gets filtered: on the server (too late) or on the provider's network (in time).

Four things to look at before price

Mitigation must happen at network level, not server level: a volumetric Layer 3/4 attack that reaches the machine has already saturated bandwidth. It also matters whether protection is always-on or on-demand: the latter activates after detection, leaving a window of exposure lasting several seconds. Then there's the data centre's infrastructure redundancy and the SLA declared by the provider. A 99.9% SLA equals around 8.7 hours of downtime per year; 99.99% drops to around 52 minutes per year — it's always worth reading exactly what the contract covers.

Provider comparison

Provider	DDoS Protection	Always-on	Suitable for
OVHcloud	Proprietary VAC system, not consumption-based	Yes, on all VPS plans	Services frequently targeted or with high-volume attacks
Contabo	Automatic DDoS protection + free firewall on every plan	Yes, included at no extra cost on VPS, VDS and dedicated servers	High resource consumption workloads with protection included
Hetzner	Basic DDoS protection included	Yes, basic filtering	Stable and predictable traffic, not frequent target
Vultr	DDoS protection as paid option	Only if purchased	Global deployments across multiple regions
DigitalOcean	Basic mitigation, designed to work with a CDN in front	Yes, basic	Developer workloads, mature ecosystem
LiquidWeb	Managed DDoS protection with technical support	Yes	Companies wanting managed support alongside protection

On the OVHcloud front, the anti-DDoS infrastructure deploys over 17 Tbps of global filtering capacity, always-on detection and mitigation at no additional cost regardless of attack volume, with no time limits once activated. The system, called VAC, comprises multiple layers — Edge Network Firewall, Shield and Armour — that first filter known attack signatures, then analyse anomalies with rate limiting and deep packet inspection, and finally clean up complex volumetric traffic before it reaches the dedicated server.

On the Contabo front, the updated official price list confirms that Core VPS includes DDoS protection, Firewall, dedicated IPv4 and IPv6 and the client control panel as standard, with automatic backups as a paid option. The Cloud VPS 8 plan, verified on Contabo's official price list on 10 August 2026 (contabo.com/en-us/vps/), costs €14.00 per month including VAT (€11.20 for the first 24 months) and offers 8 vCPU, 24 GB RAM and 300 GB SSD / 150 GB NVMe.

One layer isn't enough

For Layer 7 attacks — HTTP floods, bot traffic, API abuse — no VPS provider's network protection is sufficient alone: you need a reverse proxy or CDN in front of the service, regardless of which provider you choose for the machine. Network-level and application-level protection are complementary, not alternatives.