DDoS Protected VPS Hosting: Filtering Included, Not Upsold
Network-layer DDoS filtering is bundled on all five KVM NVMe plans from $9.99 a month, at no extra cost. This page sets out exactly what that filtering stops, what it does not stop, and how to work out whether you need it at all.
The short answer
Yes, and it is included on every plan, from VPS-1G at $9.99 a month upward. There is no security tier, no per-attack surcharge, no mitigation upgrade to buy at the worst possible moment, and no traffic-based billing that spikes during an incident. Your dedicated IPv4 address stays yours before, during and after an attack.
Why this page exists, and the numbers behind it
Because "DDoS protection included" is not the industry norm, and the difference is worth naming.
DigitalOcean does not bundle DDoS protection with its droplets at all. Vultr does not include it as standard either, and charges roughly $10 per month as an add-on, which on a plan that can itself cost under $6 a month is a line item larger than the server. When mitigation is a paid extra, the rational buyer skips it, and the first time they discover that was a mistake is the hour it matters.
We include it on every plan and we price the plan, not the protection. That is the whole commercial difference, and it is why this is a page rather than a bullet point on a feature list.
What network-layer mitigation actually does
In plain language, and without the adjectives:
- It inspects traffic before it reaches your server. Filtering happens upstream at the network edge, on our side of the connection. Attack traffic is dropped before it consumes your bandwidth or your vCPU.
- It absorbs volumetric floods. UDP floods, SYN floods, DNS and NTP amplification, memcached reflection, spoofed-source floods: the attacks measured in gigabits per second whose entire purpose is to saturate a link until nothing else fits through it.
- It keeps clean traffic moving. Legitimate packets continue to be delivered while malicious ones are discarded. The goal is that your service stays up, not merely that the attack is recorded.
- It works automatically. Nobody has to notice, page an engineer or enable a paid tier. This is not a "call us and we will turn mitigation on" arrangement.
- It does not move your address. Your dedicated IPv4 stays assigned to you throughout, so DNS, certificates, firewall rules and client allow-lists do not need to change.
What it does not protect against
Being precise here matters more than sounding strong, because most of the damage we see on small servers is not a flood.
- Application-layer attacks. An HTTP flood built from thousands of ordinary-looking requests from ordinary-looking browsers cannot be separated from a busy day by network-level filtering alone. A web application firewall, rate limiting in nginx or your framework, caching and bot filtering are the tools for that layer, and they live on your server.
- Compromised credentials. If somebody logs in with a valid password, filtering has nothing to act on. SSH key authentication, disabling password login, restricting source addresses and tools such as fail2ban are the answer, and they are yours to configure.
- Vulnerable code and unpatched software. Most compromise of a small VPS is an outdated CMS plugin, an admin panel exposed to the internet, or a database service bound to the wrong interface. No network filter reads your application logic.
- Outbound abuse from your own server. If your instance is taken over and used to attack someone else, that is outbound traffic and it is not filtered as an attack against you. It is also a fast route to an abuse complaint and a suspended service.
- Data loss. Filtering recovers nothing. Keep backups, and test that they restore.
The line between what we filter and what stays yours
Every OpenVista plan is self-managed, and that is a deliberate product decision rather than a cost cut. On our side: the physical hardware, the network, the KVM virtualisation layer, the storage, the DDoS filtering in front of your address, and a support queue that answers around the clock.
On your side: everything above the kernel. We do not log into your server to configure your firewall, patch your CMS, tune PostgreSQL, write your nginx rules or rotate your SSH keys. You have full root SSH, and that means the application layer is genuinely yours.
That division is right for a developer, an agency or a technically confident team, and wrong for a business that wants somebody else to administer the website. If you want the second thing, say so on the contact page and we will tell you honestly which side of the line you are on rather than sell you the wrong product.
How to tell whether you need it
Three questions, and the honest answers are usually obvious once you ask them.
1. Does anything about your service attract attention?
Game servers, community platforms, public APIs, services with a political or competitive edge, and anything that has been attacked before. Seeking attention is a feature of these products and a liability of their hosting.
2. Would an hour of downtime cost more than the server?
If the answer is yes, then protection is not the expensive part of your stack, and shopping for the cheapest unprotected instance is a false economy with a predictable expiry date.
3. Is your IP address public and permanent?
A dedicated IPv4 is easy to find and easy to aim at. If your address appears in DNS records, in a client allow-list or in a public API, assume it is known and treat it as a target.
If those three point the same way, you need filtering, and the question becomes whether your host includes it or sells it. Check that before you compare headline prices, because a $6 plan plus a $10 protection add-on is not a $6 plan.
Filtering included on all five plans
Specifications and pricing are identical in both of our datacentres, Rabat in Morocco and New York in the United States. Those are our only two locations. Complete detail sits on the VPS plans page.
VPS-1G — $9.99/mo
1 vCPU, 1 GB RAM, 30 GB NVMe SSD. Entry point for DNS, monitoring and small services.
VPS-2G — $19.99/mo
1 vCPU, 2 GB RAM, 40 GB NVMe SSD. Client sites, internal tools, staging.
VPS-3G — $34.99/mo
2 vCPU, 3 GB RAM, 50 GB NVMe SSD. Containerised apps, queues and APIs.
VPS-4G — $39.99/mo
2 vCPU, 4 GB RAM, 80 GB NVMe SSD. Databases, Odoo and e-commerce with real traffic.
VPS-5G — $49.99/mo
3 vCPU, 5 GB RAM, 100 GB NVMe SSD. Build runners, CI and heavier workloads.
Included on every plan
- KVM virtualisation, full root SSH
- NVMe SSD storage
- Dedicated IPv4 address
- DDoS protection at no extra cost
- 99.9% uptime SLA
- 24/7 support, English and French
- 15+ Linux distributions
- Automated deployment in minutes
- Monthly billing, no contract
Frequently asked questions about DDoS protection
Is there a separate fee for DDoS protection?
No. It is included in the plan price on all five plans, from $9.99 a month. There is no premium security tier, no per-attack charge and no invoice that grows because you had a bad week.
Will mitigation slow down legitimate traffic?
Filtering happens at the network edge, and in normal conditions you will not notice it. During a large attack, some legitimate packets can be caught in the filtering while the profile is being matched, so a small number of real users may see retries. We would rather describe that honestly than claim mitigation is invisible in every scenario.
Do you blackhole or null-route my IP during an attack?
Some providers respond to a large attack by null-routing the target address, which stops the attack and your service at the same time. Our approach is upstream filtering so that clean traffic keeps arriving. We will not promise that no attack will ever be noticeable, because that would be a claim nobody can keep. We will promise that mitigation is never a product we charge you for.
Does this protect against application-layer attacks and hacking?
No, and anybody who tells you otherwise is selling. Network-layer filtering cannot distinguish a malicious HTTP request from a legitimate one. Web application firewalls, rate limiting, good patching and access control are separate work, and on a self-managed server that work is yours.
Is DDoS protection available in both datacentres?
Yes. Rabat and New York are the only two locations we operate, and both include the same filtering at no extra cost. There is no quieter location that comes with better protection as an upgrade.
Do I need a managed service to be protected?
No. Filtering is applied in front of your address regardless of how you administer the server. What managed support would change is who handles the application layer above the kernel, and that is a separate decision from DDoS protection.
Protection that is already in the price
KVM virtualisation, NVMe SSD, a dedicated IPv4, DDoS filtering and a 99.9% SLA from $9.99 a month. Monthly billing, no contract, deployed in minutes.