The 10 step checklist
1. Host on a network with DDoS protection
This is the one that matters most. A flood that fills your connection cannot be fixed by anything on the server, because the damage is done before the traffic arrives. Your host needs always-on mitigation upstream, and it should not null-route your IP when an attack gets big.
2. Keep your origin IP private
If your site or game sits behind a proxy or protected address, make sure the real server IP is not exposed in DNS records, mail headers, old subdomains or game server listings. Attackers look for it so they can go around the protection.
3. Close every port you do not use
Each open port is something that can be flooded or abused. Close anything you do not need, ideally at the network edge so the traffic never reaches the server at all.
4. Filter traffic by protocol
For UDP services such as games and VPNs, a bandwidth limit is not enough. Protocol-aware filtering checks that each packet looks like the game or VPN protocol it claims to be and drops the rest, so a flood on the port never reaches the software.
5. Turn on SYN flood protection
SYN floods fill the server's table of half-open connections. SYN cookies on the server help, and a SYN proxy in the network in front of it is better, because the server only sees clients that have completed the handshake.
6. Limit new connections per source
Cap how many new connections or flows a single address can open in a short time. Set the limit high enough for real bursts, such as a group of players joining together, and never limit sessions that are already established.
7. Patch and harden your services
Make sure your own server cannot be used in someone else's attack. Close open DNS resolvers, NTP and memcached to the internet, keep software updated and change default passwords on everything.
8. Monitor traffic and set alerts
You want to know an attack has started before your users tell you. Watch inbound traffic and packet rates, and set up alerts that fire when an attack starts and when it ends.
9. Leave headroom and cache what you can
A server running at its limit falls over sooner. Leave spare capacity, and serve static content from a cache or CDN so application-layer floods have less to hit.
10. Write an incident plan
Decide in advance who does what, which services can be switched off, how to tighten limits and who you contact at your host. Five minutes of planning saves a lot of panic during an attack.
Why a server firewall is not enough
iptables, nftables and Windows Firewall are useful for closing ports and blocking known bad addresses, but they run on the server. A volumetric attack has already filled your connection by the time those rules see a packet. Network-level protection in front of the server is the only fix for that.
What to do during an attack
- Check your host's graphs or status page to confirm it is an attack and not a fault.
- Switch on any under-attack mode your protection offers, or tighten connection limits.
- Close anything non-essential that is exposed to the internet.
- If your host has null-routed your IP, move to a provider that filters attacks instead of blackholing them.
On Glitch Servers, steps 1, 3, 4, 5, 6 and 8 are handled by Glitch Guard, which is included with every VPS and dedicated server.
Frequently Asked Questions
Next Steps
New to the topic? Start with what is a DDoS attack. To see the common attack types and how each is stopped, read DDoS attack examples.
Want protection that is already set up?
Every Glitch Servers VPS and dedicated server comes with always-on DDoS mitigation and Glitch Guard per-IP filtering at no extra cost, and game servers and web hosting are protected as standard.