Cloudflare DDoS Protection is the always-on attack mitigation built into Cloudflare's network. Cloudflare provides unmetered and unlimited DDoS protection at layers 3, 4 and 7 to all customers on all plans and services, and its billing excludes DDoS attack traffic from your usage.
Protection applies up to the layer your service runs on. Proxied websites and APIs are protected at layer 7 and below; other TCP and UDP applications are onboarded through Spectrum, and IP networks through Magic Transit. It covers web and network protocols, but not email protocols such as SMTP, IMAP or POP3.
It only protects traffic that reaches Cloudflare. A DNS record left unproxied, or an origin that accepts connections from anywhere, gives an attacker a way around it. That is why the configuration needs an owner after go-live.
Each server samples traffic out of path, so detection adds no latency. Cloudflare documents up to three seconds on average to detect and mitigate an attack at the edge, and its mitigation rules expire shortly after the attack ends.
The HTTP DDoS Attack Protection ruleset covers layer 7 floods. The Network-layer DDoS Attack Protection ruleset covers attacks such as UDP floods, SYN floods and DNS floods. Both are always on. You can adjust the HTTP ruleset; Enterprise Magic Transit and Spectrum customers can also customize the network-layer one.
Managed DDoS rules run at a default sensitivity of High. An override changes a rule's sensitivity or action for your zone, for example when a legitimate traffic pattern resembles an attack.
Adaptive rules profile your traffic over the past seven days and detect traffic that deviates from it. Every plan gets the adaptive rules based on origin errors; the full set needs the Enterprise Advanced DDoS Protection add-on.
Cloudflare sends DDoS attack alerts within about a minute. An HTTP DDoS alert is included on every plan; advanced alerts with filtering and network-layer alerts depend on Enterprise add-ons, Magic Transit or BYOIP.
Cloudflare recommends proxying the DNS records that serve web traffic, allowing only Cloudflare IP addresses at the origin, rotating origin IPs that were public before onboarding and not placing another CDN in front of Cloudflare.
| Plan | What it includes |
|---|---|
| Free | Unmetered layer 3 to 7 DDoS protection, the HTTP and network-layer managed rulesets, one ruleset override, adaptive rules based on origin error rates and DDoS alerts. |
| Pro | Everything on Free. Spectrum is available as a paid add-on for SSH and Minecraft, one application each. |
| Business | Everything on Pro, with adaptive profiling that also uses historical traffic trends. The Spectrum add-on can also cover one RDP application. |
| Enterprise | Everything on Business. Add-ons include Spectrum for any TCP or UDP application, Magic Transit for IP networks with Advanced TCP Protection and Advanced DNS Protection (beta), and Advanced DDoS Protection: up to 10 ruleset overrides, all adaptive rules and advanced alerts. |
Cloudflare's prices and add-on terms change, so this table lists capabilities only. Vigilbase sells Cloudflare Enterprise licences and scopes add-ons such as Spectrum or Magic Transit with the operation. Vigilbase Shield is a pre-Enterprise monthly plan with managed WAF, DDoS protection and Super Bot Fight Mode.
Cloudflare plan prices, Free to Enterprise →For each production hostname we record what it serves, whether it is proxied and whether the origin can be reached directly. Unproxied records and exposed origins go into a change record with an owner and a next action.
DNS changes when you move an origin, and someone has to own the record and the cutover. We record what changed, why, who approved it and how the result was checked.
Campaigns, releases and new integrations change what normal traffic looks like. We check customer impact alongside the security event before adjusting a managed rule, and keep each change narrow enough to evaluate.
A network-layer flood and a burst of malicious checkout requests need different investigations. We review Cloudflare events, origin health, DNS and an affected customer journey in parallel, then change one control at a time.
Critical adds war-room activation, proactive edge network defence and BGP and routing ownership, for environments where waiting in a queue is not acceptable.
Core is business-hours governance and change management, with best-effort response. Priority adds 24/7 operations, active threat mitigation within the SLA and a named technical account manager. Critical adds immediate escalation and senior incident leadership.
A DNS-only record exposes the origin IP to anyone who queries it, and an open origin can be attacked directly. We proxy the records that serve web traffic, restrict the origin to Cloudflare and verify that the change holds.
A launch or a campaign can resemble an attack, and an overbroad mitigation blocks real customers. We confirm the affected journey before overriding a rule, then record the change and how to roll it back.
An alert is not an operator. On Priority and Critical, Vigilbase leads the Cloudflare incident outside business hours, with response times set by the SLA.
Coverage and incident response commitments →Emergency onboarding moves exposed web traffic behind Cloudflare, then stabilizes DDoS, bot, TLS, WAF and origin-pressure issues. It is Cloudflare incident work, not generic incident response.
When to request Cloudflare emergency help →Vigilbase OS
Vigilbase OS, the cybersecurity operating system, connects the security tools you already pay for and keeps their logs and events auditable and queryable in one place. Its native Cloudflare integration puts your Cloudflare events next to those tools, and the Vigil agent investigates high-severity incidents while Vigilbase analysts handle exceptions.
Cloudflare is the provider where live response actions run today. You choose the autonomy: keep actions off, propose them for approval, or allow low-risk, reversible actions to run. The record shows the investigation, the actions taken and the verification. For providers without live actions, the investigation returns the steps for your team to complete.
Get started with Vigilbase OSYes, on every plan. Cloudflare provides unmetered and unlimited DDoS protection at layers 3, 4 and 7 to all customers, and its billing excludes DDoS attack traffic from your usage.Plans and add-ons change how far you can tune the protection and what it covers. Spectrum protects other TCP and UDP applications, Magic Transit protects IP networks, and the Enterprise Advanced DDoS Protection add-on adds overrides, adaptive rules and advanced alerts.Understand DDoS attacks
Cloudflare documents up to three seconds on average to detect and mitigate HTTP and network-layer DDoS attacks at the edge. Detection runs on every server without waiting for a central decision, and mitigation rules expire shortly after the attack ends.Understand DDoS attacksRespond to a DDoS attack
Usually because some traffic does not pass through Cloudflare. A DNS-only record exposes the origin IP, and an origin that accepts connections from anywhere can be attacked directly.Cloudflare recommends proxying the records that serve web traffic, allowing only Cloudflare IP addresses at the origin and rotating origin IPs that were public before onboarding. Check each production hostname, not only the main website.Respond to a DDoS attackA practical website protection guide
Protection applies up to the layer your service runs on. Proxied websites and APIs are protected at layer 7 and below; other TCP and UDP applications are onboarded through Spectrum, and IP networks through Magic Transit. Email protocols such as SMTP, IMAP and POP3 are not covered.Understand DDoS attacksCloudflare Enterprise licensing explained
On Priority and Critical, Vigilbase monitors 24/7 and leads mitigation within the SLA; Critical adds immediate escalation and a war room. Core is business-hours governance, so your team keeps the pager.If the affected service is not on Cloudflare yet, emergency onboarding moves exposed web traffic behind Cloudflare first and then stabilizes the attack.Coverage and incident response commitmentsWhen to request Cloudflare emergency help
Cloudflare's DDoS mitigation is unmetered on every plan. Managed Cloudflare operating fees start at $3,500 a month for Core, $7,500 for Priority and $15,000 for Critical; the Cloudflare licence and any add-ons are scoped in the same quote.Compare Core, Priority and CriticalWhat to check before buying Cloudflare
Cloudflare DDoS protection details on this page are summarized from Cloudflare's documentation. Plans, add-ons and limits change, so confirm current terms with Cloudflare or with us before you buy.
Vendor sources checked
Tell us which applications and domains matter and who holds the pager today. We will scope the Cloudflare licence, any add-ons and the operating coverage together.
