1

Any PaaS/shared hosting company which I came across offers its customers to protect their websites from DDoS via security-oriented CDNs such as CloudFlare or CloudFront which act as a proxy distributing the content serving via various machines (instead just one machine - the one which hosts the website).

Is the idea of a hosting provider with built-in DDoS protection plausible? I mean, is the idea of a hosting provider doing the machine serving distribution by itself (without involving a third party) plausible?

Improve this question
4
  • This looks less like a security question to me and more like a business question. Fighting DDoS takes a lot of resources. So unless one is a huge hosting provider with lots of resources it is more cost efficient to just outsource DDoS protection. But from a pure technical perspective it would sure be possible.
    – Steffen Ullrich
    Feb 11, 2021 at 15:23
  • I understand your point about business question. Thanks.
    – Semo
    Feb 11, 2021 at 15:53
  • Is it plausible? Sure. Is it plausible with a certain set of resources? That depends on the resources. It sounds like you have a particular set of resources in mind.
    – schroeder ♦
    Feb 11, 2021 at 15:55
  • @schroeder I personally don't provide hosting (and never did and don't think I will ever do that); I just want to better understand why is it really a matter of outsourcing or thus I learned each time anew... I would prefer to get such protection from a hosting provider without changing nameservers, open a cloudflare account, etc, or even just toggling on/off a "cloudflare" option.
    – Semo
    Feb 11, 2021 at 15:58

2 Answers 2

Reset to default
0

Cloudflare technically does support hosting websites via their Cloudflare Workers service, so in that sense you could trivially say that if you use Cloudflare Workers you could get hosting and DDoS protection from the same company. The big players in cloud (AWS, Azure, Google Cloud) also all offer DDoS protection services, so the same applies if you host your website on any of those services.

DDoS protection is not an easy service to offer because ultimately it's a battle of who has more network capacity - the attacker or the defender? If you want to be confident that you can absorb any DDoS attack, you need to build a network with massive capacity and footprint all over the world. Generally the only companies able to do that well are ones that specialize in DDoS protection, or big tech companies that already have a lot of infrastructure to power their own services.

Improve this answer
2

It depends on what you mean by DDoS protection.

If you mean be able to serve normal request even when facing a DDoS attack using a very large number of relays, then the only way if to use a CDN that will be able to absorb the increased load.

If you mean to detect clients sending requests at an abnormal rate, and limit that rate, then a good proxy in front of the application server might do the job. If the number of relays is not too high, normal clients would notice a delay but the system would still be useable.

If you mean to protect the application and prevent it to crash because of the load, a good proxy is enough. It will limit the number of simultaneous requests, and the application will continue to work fine. Normal clients would notice that the system is hard to use or even unreachable during the attack, but everything will be fine as soon as the attack will stop.

Those last 2 ways are often combined on systems that (often for security reasons) do no want to rely on a third party service.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .