DDoS Protection Pricing Models: Flat Tiers, Per Attack or Clean Traffic

DDoS protection pricing follows five main models: an included baseline with an allowance, flat monthly capacity tiers, per attack fees, clean traffic billing, and per IP or per prefix pricing. At voxa.host the model is flat. Every server includes 100 Gbps of Layer 3 and Layer 4 protection, and paid tiers start at €156.45 per server per month.

The headline price is rarely the real monthly cost. This guide covers each model, the hidden costs to check in any offer, and three worked monthly totals.

What are the main DDoS protection pricing models?

Every offer answers three questions: what you pay when nothing is happening, what you pay during an attack, and what happens when an attack is bigger than the plan. The models differ in which of those they push onto your bill.

Included baseline with an allowance

Protection up to a set capacity is bundled into the server price. Above it a policy takes over: a few oversized attacks are still filtered, then a fallback such as null routing applies. It suits most servers, because most are rarely attacked. The catch is the fallback, so read the over cap policy before the capacity figure.

Flat monthly capacity tiers

You choose a mitigation capacity, such as 500 Gbps or 2 Tbps, and pay a fixed monthly price whether you are attacked or not. It suits regular targets and fixed budgets. The catch is that you size the tier yourself and pay for headroom in quiet months. Our guide on how much DDoS protection you need covers the sizing.

Per attack or per incident fees

A low or zero standing fee, plus a charge each time mitigation runs: per incident, per hour or per gigabit filtered. It suits services attacked once in a long while. The catch is that the attacker now controls your bill. Eight short floods in a month are eight charges, and you need to know how an attack that pauses and restarts is counted.

Clean traffic billing

You pay for the legitimate traffic delivered to you after filtering, often per Mbps at the 95th percentile. Traffic is sampled every five minutes, the top 5 percent of the month's samples are discarded, and the bill uses the highest one left.

A 30 day month has 8,640 five minute samples, and 5 percent of them is 432 samples, or 36 hours. Short bursts vanish into that slice, but anything above your normal level for more than 36 hours sets the bill. It suits high traffic web services already behind a filtering proxy. The catch is that a busy sale month costs more, and the measure must be taken after filtering, not on raw traffic.

Per protected IP or per prefix pricing

The fee is set per protected IP address, or per announced prefix for organisations with their own address space (a /24 is 256 addresses). It suits single address services and companies with their own IP ranges. The catch is multiplication: eight addresses mean eight fees, and an unprotected address on the same server is still a way in, because a flood aimed at it fills the shared port.

DDoS protection pricing models compared

Model	How it bills	Who it suits	The catch
Included baseline	Bundled up to a capacity, then an over cap policy	Most servers	The fallback, often null routing
Flat capacity tiers	Fixed monthly price for a chosen capacity	Regular targets, fixed budgets	Headroom paid for in advance
Per attack or per incident	Small standing fee plus a charge per attack, hour or gigabit	Rarely attacked services	The attacker sets the number of charges
Clean traffic	Per Mbps of legitimate traffic, often at the 95th percentile	High traffic web services	Grows with normal traffic, must be measured after filtering
Per IP or per prefix	A fee for each protected address or prefix	Single address services, own IP ranges	Multiplies with addresses
On demand activation	A fee per activation, sometimes plus a standby fee	Very rarely attacked services	Each activation is a separate charge

Many offers combine two of these, such as a flat tier with a per attack charge above it. When you compare DDoS mitigation pricing, price each part separately.

What hidden costs should you check in a DDoS protection offer?

Five questions decide the real DDoS protection cost. Get each answer in writing before you compare headline prices.

What happens above the cap

Most offers end in a null route: the network drops all traffic to the targeted address at its edge, so the attack stops and so do your customers. It protects the rest of the network, but for you it is an outage with a zero on the invoice. Our explainer on null routing and blackholing shows how it works.

Put a price on that outage. Example: a service that earns €3,000 a day loses more in one null routed day than a year of the 500 Gbps tier costs (€156.45 a month, or €1,877.40 a year).

Metered bandwidth that turns an attack into a bill

If your traffic is metered, check whether attack traffic counts. A 10 Gbps flood lasting one hour is 36,000 gigabits, or 4.5 TB, which lands on the invoice of any plan that bills inbound traffic per GB.

Outbound counts too. Example: 2,000 HTTP requests a second answered with a 50 KB page is about 100 MB a second (800 Mbps), or 3.6 TB over ten hours. Our guide to bandwidth and data transfer limits explains metered and unmetered ports.

Setup fees

Some offers charge a one off fee to onboard a server, an address or a prefix, and charge it again when you change tier.

One IP or the whole server

A price per IP looks lower than a price per server until you count addresses. Example: at a hypothetical €25 per protected IP, a server with six addresses costs €150 a month.

Whether Layer 7 is included or separate

Gbps and Tbps figures describe volume floods at Layer 3 and Layer 4. An HTTP request flood can exhaust a web server long before it fills the port, because each request costs CPU and database time. Check whether Layer 7 filtering is included, a separate line or absent. Our guide to Layer 7 DDoS protection and HTTP floods covers what your own stack can do.

How much does DDoS protection cost at voxa.host?

We price DDoS protection per server, as an included baseline plus flat capacity tiers. Every KVM VPS and every dedicated server includes 100 Gbps of always on protection at Layer 3 and Layer 4, filtered upstream and active from delivery, at no extra charge.

Tier	Layers	Per month
100 Gbps	L3/L4	Included
500 Gbps	L3/L4	€156.45
1 Tbps	L3/L4	€523.95
2 Tbps	L3/L4	€1,048.95
5 Tbps	L3/L4	€2,623.95
10 Tbps + Layer 7	L3/L4/L7	€4,723.95

Prices are per server, per month, excluding VAT, and each tier covers every IP address on that server.

• No per attack fee. A month with a dozen attacks costs the same as a quiet one.
• Above the included cap. The first 5 attacks a month that exceed 100 Gbps are still mitigated at no charge. From the 6th in the same month, the targeted IP address is null routed until the attack ends or the server is upgraded to a larger tier. Only that address, not the whole server.
• Layer 7 only on 10 Tbps. On every other tier, HTTP floods are handled in your own stack with rate limits, caching and connection limits.
• Unmetered ports. Dedicated server ports and VPS traffic are unmetered, so an attack cannot turn into a traffic bill.
• How to buy. Choose the tier as an add on at checkout when you order a VPS or dedicated server, or upgrade an existing server later from the client area.

What does DDoS protection cost per month in practice?

These three setups are examples, not quotes. Server prices are our monthly list prices (the dedicated ones include the default 1 Gbps guaranteed unmetered port), and everything excludes VAT.

Example	Servers	Protection	Monthly total
1. Single VPS	Core VPS €11	Included 100 Gbps, €0	€11.00
2. Public edge plus backend	Dual Xeon E5 2690 v4 €229, Single EPYC 9254 €449	500 Gbps on the edge, €156.45	€834.45
3. High exposure platform	Dual EPYC 9554 €959, Dual EPYC 9254 €679	10 Tbps + Layer 7 on the front, €4,723.95	€6,361.95

Example 1: a single VPS on the included tier

A small business site runs on a Core VPS (2 vCPU, 8 GB RAM, 60 GB) at €11 a month at the base location price and keeps the included 100 Gbps, so the whole bill is the server. The 500 Gbps tier would cost over fourteen times the server. That is the right signal: for one small VPS, the included tier and its five over cap attacks a month are the place to stop.

Example 2: one public edge server on 500 Gbps

A business puts its reverse proxy on a Dual Xeon E5 2690 v4 at €229 with the 500 Gbps tier at €156.45. Its application and database run on a Single EPYC 9254 at €449, kept out of DNS, firewalled to accept traffic only from the edge, and left on the included tier.

Because a tier is priced per server and covers every IP on it, the business pays for one larger tier where public traffic lands, not for every machine. HTTP floods are handled at the edge with rate limits and caching, as our guide on DDoS protection for APIs and SaaS sets out.

Example 3: a high exposure platform on 10 Tbps with Layer 7

A platform that draws large and frequent attacks, HTTP floods included, runs its public front on a Dual EPYC 9554 at €959 with the 10 Tbps tier at €4,723.95. Its data sits on a Dual EPYC 9254 at €679 on the included tier.

Protection is now most of the bill, so the pricing model matters more than the server. A flat tier costs the same in a month with one attack or thirty, where a per attack model would add a charge for each.

How do you compare two DDoS protection quotes?

Turn each offer into one monthly figure for a bad month, not an average one.

1. Multiply the protection fee by the units it is charged on (servers, addresses or prefixes) and add the server price.
2. Add per attack charges for a realistic bad month. If you saw six attacks last quarter, price a month with six.
3. Add traffic you would pay for: metered overage, or legitimate traffic at its 95th percentile.
4. Spread setup fees over the months you expect to keep the service.
5. Price the fallback: how many over cap attacks are covered, and what a null routed address costs you.
6. Check Layer 7 separately.

The lowest headline is often not the lowest total once a bad month is priced in.

Next step: pick a tier for each public server

Start from the servers that face the internet, treat the included 100 Gbps as the baseline, and add a tier only where the exposure calls for it. The DDoS protection page lists every tier and the over cap policy, and the dedicated server range shows the servers it attaches to.