Which cloud based, scalable web service is best for DDOS prevention? [closed]

Question

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.

Closed 8 years ago.

I have an idea for a website that I would like to develop and release. It is a web application that I would like to implement on some form of cloud-based web hosting service (i.e. the Google App Engine, Amazon Web Services, others that I may not be aware of...)

My problem is that even though my project is 100% legal, and not shady, it is highly susceptible to occasional DDOS attacks.

I've previously developed for the GAE and I am quite biased toward it. However, I can't seem to find that the Google service has any form of integrated DDOS protection. In fact, Google's on documentation states that if you think you've experienced a DDOS attack, you must provide the burden-of-proof, which they will research. If they think you have been attacked, they will reimburse you usage fees. Otherwise, you are left on your own.

Are there better, cloud-based hosting alternatives? I have my preferences, but I'm not married to any specific type of architecture or programming language.
What are my best cloud-based web hosting options for DDOS protection?

Answer 1

CloudFlare seems to be what you need. The only thing I don't like about CloudFlare is that you have to use their DNS servers for your whole domain even if you just want to protect a subdomain.

Answer 2

Google App Engine does provide DoS protection: see Python, Java and Go documentation.

Answer 3

I actually work for CloudFlare and thought I would jump in...

"There might be no catch as there are many services that are free for the lowest plan. Maybe they hope that you will be interested in buying their premium services." Correct. We can also monetize the service through features, apps, etc.

@RLH We can offer some help with DDoS mitigation. "I'm Under Attack" can help mitigate many common http:// attacks & the basic nature of our network can help mitigate attacks as well.

Answer 4

You will never find "free" DDos protection because, in order to protect you from DDos, a provider must "swallow" your extra traffic - thus using bandwidth which costs money.

All free DDos protection services I know, including those listed above, are given on "availability basis" - meaning they will only protect you from smaller attacks and only if the rest of the network can handle it.

Then again, this`s only fair. Your cannot get a cheap DDos solution, because solving DDos is never "free" or "cheap".

However, while "free" DDoS mitigation is not yet reliable, there are several trustworthy and affordable solutions. Check out this Top10Review, it pretty much sums it all up:

http://website-security-and-performance-review.toptenreviews.com/

Answer 5

Since you have this tagged as "Amazon Web Services", I thought I comment on that aspect.

AWS works with a well-known network security vendor to automatically provide DDoS protection services to their network. Sometimes more sophisticated (or targeted) attacks get through though. In that case, you can contact the AWS security team and they'll help you triage your application.

It's also worth noting that if you're smartly using autoscaling, that can be a serious help in mitigating the problems caused by a DDoS.

Answer 6

There are certain things to consider before going on a Cloudflare plan, either free or paid: http://kwatog.com/blog/moving-out-of-cloudflare/

I would suggest you to try Incloudibly https://incloudibly.com/ - scalable Cloud hosting with free DDoS protection up to 10 Gb/s.