Basic vs Advanced DDOS Protection

From Cloudflare DDoS Protection & Mitigation it doesn’t differentiate between what free/pro plan users get for basic DDOS protection versus what Business/Enterprise plan users get for Advanced DDOS protection ?

But the page Cloudflare DDoS Protection & Mitigation is titled Advanced DDOS protection so that is what only Business and Enterprise plan users get listed on Cloudflare DDoS Protection & Mitigation ?

Edit: ah the I’m under attack mode is only available to free/pro users !

1 Like

According to the plans page, Free and Pro customers get this kind of DDoS protection:

Basic DDoS protection. Cloudflare’s basic DDoS protection allows legitimate traffic to reach your website, while stopping illegitimate traffic at the edge, before it hits your server. Basic DDoS protection is limited in our Free and Pro plans, and based on the attack’s disturbance to our network.

Business and Enterprise customers get:

Advanced DDoS protection - Layers 3 and 4. Cloudflare automatically stops TCP SYN, UDP and ICMP attacks at the edge so they never reach your origin server.

Advanced DDoS protection - Layer 7. Automatically detects sudden changes in traffic and protects against layer 7 DDoS attacks, such as POST floods and DNS-based attacks, so they never reach your origin server.

Advanced DDoS support. Backed by a full SLA, our DDoS experts will keep you online 24/7/365 no matter the size, type, or duration of the attack.

With Enterprise customers also getting:

  • Sustained speeds via dedicated IP ranges
  • Emergency support engineer

The DDos page you’re referring to seems to be with features for Business and Enterprise customers, judging from the text and described use cases.

Hope this helps!


thanks @JuM :slight_smile:

Mind explaining “Advanced DDoS protection - Layers 3 and 4.” a bit more? Cloudflare can’t possibly not filter those attacks for free users, if so paid users on the same server would also go offline. I get the Layer 7 because you can choose which sites to filter floods on, but you can’t filter a TCP SYN Flood for some users when free and paid users share the same IP.

they probably have separate ips/resources for their business and enterprise plan users hence the higher price ?

Only Enterprise has separate ips. It’s so Cloudflare can customize the ACLs on a per customer basis.

Cloudflare is happy to announce Unmetered DDoS Mitigation for all plans (even free :)).

More can be found on our blog here:


cheers @garret that’s good news :slight_smile: