A DDoS attack is simple to describe and miserable to live through. Someone floods your server or network with junk traffic until real visitors cannot get through. Your site looks "down" even though nothing is wrong with your code.
Most hosting pages mention "DDoS protection" somewhere in the feature list. The details vary wildly. Before you assume you are covered, ask your host these five questions.
1. What size attack are you actually protected against?
"Anti-DDoS included" might mean basic volumetric filtering at the data centre edge. It might mean nothing until you pay for a premium tier. Ask for numbers if they can share them: mitigation capacity in Gbps, whether scrubbing is always on or triggered manually, and what happens when traffic exceeds that cap.
Small business sites rarely see nation-state scale attacks. They do see nuisance floods that take a WooCommerce store offline during a sale. Know whether your plan covers that class of event or only the headline number on the marketing page.
2. Where does mitigation happen?
Protection can live at different layers:
- Network edge (provider scrubs traffic before it hits your server)
- On the server (firewall rules, rate limits, fail2ban-style tools)
- Third-party CDN/WAF (Cloudflare, etc. in front of your origin)
Edge mitigation is what you want for large volumetric attacks. Server-only rules help with brute force and small floods but will not save a VPS whose pipe is saturated. If the host says "we use CloudLinux and a firewall," that is good hygiene, not a full DDoS answer.
3. What happens to my site during an attack?
Clarify the user experience:
- Is traffic scrubbed transparently while legitimate users still get through?
- Does your IP get null-routed (blackholed) until the attack stops?
- Are you notified, and how fast?
- Is there a manual step where you must open a ticket before mitigation kicks in?
Null routing stops the attack from hurting the provider's network. It also makes your site unreachable for everyone. Some plans treat that as normal. You should know that upfront.
4. Is protection included or an add-on?
On VPS and dedicated servers, DDoS mitigation is sometimes an extra monthly fee or only available in certain data centres. On shared hosting it may be bundled because you share fate with hundreds of accounts on the same node.
Ask what triggers extra charges: sustained attack duration, mitigation hours, or upgrading to a "protected IP" tier. Budget for it if you run ecommerce, ticketing, or anything where an hour offline has a dollar cost.
5. What should I do on my side before and during an attack?
Good hosts give you a runbook, not just infrastructure:
- Put a CDN or WAF in front of public sites when traffic matters
- Rate-limit login and API endpoints at the application layer
- Keep DNS TTLs low enough to shift traffic if the host provides a scrubbed endpoint
- Know who to call (phone vs ticket) and what info they need (timestamps, logs, affected URLs)
DDoS is not only the host's problem. Weak WordPress login endpoints and exposed admin URLs make you an easier target. Fix the obvious stuff while you negotiate plan details.
Canadian hosting context
Attacks do not respect borders, but where your server lives still matters for latency, support timezone, and who you talk to when traffic spikes at 9 p.m. local. Swift Host deploys to Canadian data centres with network-level filtering on cloud plans and documents what is included per tier. Our VPS hosting and public cloud pages are the starting point; specifics depend on your traffic profile and whether you need always-on scrubbing.
Bottom line
Do not treat "DDoS protection" as a checkbox. Ask about capacity, where scrubbing happens, what users experience during an attack, what it costs, and what you should do when alerts fire.
Running a site that cannot afford downtime? Talk with Swift Host. We will walk through your stack and tell you honestly what is covered on your plan and what needs a CDN or upgrade.
