Introduction
Distributed Denial‑of‑Service attacks aim to overwhelm your server. This guide covers multi‑layered DDoS protection for your VPS.
1. Understand Attack Types
Volumetric (bandwidth exhaustion), protocol (SYN floods), application‑layer (HTTP floods).
2. Hostxpeed DDoS Protection
Hostxpeed includes always‑on DDoS mitigation up to 2.5 Tbps (network‑level).
3. Rate Limiting with Nginx
limit_req_zone $binary_remote_addr zone=one:10m rate=10r/s; – limits requests per IP.
4. SYN Cookie Protection
Enable in sysctl: net.ipv4.tcp_syncookies = 1.
5. Cloudflare as Reverse Proxy
Even free Cloudflare plan provides DDoS mitigation and hides your origin IP.
6. Load Balancing Across Multiple IPs
Use DNS round‑robin, anycast, or a load balancer to distribute attack traffic.
7. Application‑Layer Detection
Use ModSecurity to detect and block DDoS bots by user‑agent or behavior.
8. Limit Connections per IP (iptables)
iptables -A INPUT -p tcp --dport 80 -m connlimit --connlimit-above 50 -j DROP.
9. Use CDN for Static Resources
Offload static assets to CDN to reduce server load during attacks.
10. Fail2ban for Application DDoS
Detect and ban IPs requesting the same URL excessively (e.g., brute‑force on wp-login).
11. BGP Scrubbing / RTBH
Hostxpeed can reroute traffic to scrubbing centers on detection.
12. Auto‑Scaling Under Attack
Script creation of additional VPS and add them to a load balancer (advanced).
13. Preventing DDoS via Unauthenticated APIs
Require API keys and implement request signing.
14. Disable XML‑RPC in WordPress
Prevent amplification attacks via pingbacks.
15. Monitoring Attack Metrics
Use Netdata to detect spikes in connections, bandwidth, or SYN packets.
16. Rate Limiting for Login
Use fail2ban or application rate limiting for login endpoints.
17. Geoblocking
Block countries where you have no legitimate traffic (use Nginx geo module).
18. Dedicated DDoS Hardware (Edge)
Hostxpeed’s network includes next‑gen scrubbing appliances.
19. Incident Response Plan for DDoS
Know whom to contact at Hostxpeed, have a backup CDN, and consider temporary IP change.
20. DDoS Testing
Simulate attacks within legal boundaries (coordinated testing).
Conclusion
Rely on Hostxpeed’s network protection, then add rate limiting and application‑layer defences. Have a response plan.