Your OVHcloud server suddenly absorbs 40 Gbps of junk traffic. The dashboard shows “Anti-DDoS active” and the site stays online. Reassuring — and incomplete. Included does not mean unlimited, and protected at the network does not mean protected at HTTP.
OVHcloud communicates heavily on mitigation capacity — historically one of its strengths versus low-cost VPS. A useful investigation reads which product, which layer, and which load are actually covered.
What “standard” included Anti-DDoS covers
On most VPS, dedicated servers, and Public Cloud instances, automatic mitigation filters volumetric attacks at network level (L3/L4). Traffic is scrubbed through OVHcloud infrastructure before hitting your IP.
Typical protection:
- massive UDP/TCP floods;
- some SYN attacks;
- bandwidth saturation on public IP.
What it does not replace:
- WAF against SQL injection or XSS;
- fine L7 protection (intelligent HTTP flood);
- application rate limiting on APIs;
- CDN to absorb legitimate peaks.
| Layer | OVHcloud standard included | Often still needed |
|---|---|---|
| L3/L4 volumetric | Yes (by offer) | Monitoring alerting |
| L7 HTTP | Partial / limited | CDN + WAF |
| Application | No | Code hardening, cache |
| DNS | No (if external DNS) | DNSSEC, anycast DNS |
Shared, VPS, dedicated: three different perimeters
A common mistake: assuming shared hosting gets the same treatment as a dedicated server with its own IP. On shared, you share infrastructure; mitigation exists, but visibility and tuning options are limited.
On VPS or Public Cloud, you expose a public IP — included mitigation becomes central. On bare metal, OVHcloud highlights high network capacity; Game offers add profiles for latency and UDP traffic.
See the OVHcloud profile: the catalogue runs from shared to HDS-certified cloud — DDoS protection is not identical across the line.
Anti-DDoS Game and advanced options
For esports, streaming, or game servers, OVHcloud offers Anti-DDoS Game variants tuned for UDP and reactive traffic. That is not the same profile as a WordPress site or REST API.
“Included” on a Game sheet means Game profile — not automatically e-commerce HTTP profile.
If you run high-traffic WooCommerce, you often combine:
- included OVHcloud network mitigation;
- CDN (Cloudflare, Fastly, or OVH CDN);
- application cache and rate limits on login/checkout.
What operational feedback shows
Satisfied teams size the offer to the right product and add an L7 layer when the business requires it. Disappointments mostly come from:
- HTTP attacks not blocked despite the Anti-DDoS badge;
- false positives blocking crawlers or webhooks;
- confusion between vRack, Load Balancer, and IP Failover — building blocks to configure, not magic toggles.
Before a risky launch (flash sale, online vote), simulate a peak and verify logs + alerting — not just the marketing page.
The crux: included mitigation is not your continuity plan
The main risk is not missing protection. It is the illusion of full coverage on a complex site without CDN or application hardening.
Decide and move forward without blind spots
- Identify attack surface: direct IP, API, WordPress admin, webhooks.
- Read the exact product sheet (VPS, dedicated, Game) on ovhcloud.com.
- Add L7 for critical e-commerce or public API.
- Document the procedure for support tickets on false positives.
Compare network offers in our OVHcloud directory profile and Leaseweb vs OVH bare metal if transit is also in scope.
Frequently asked questions
Is OVHcloud Anti-DDoS free?
Basic mitigation is included on most VPS, dedicated, and Public Cloud. Advanced options (Game, stronger filtering) are add-ons by product.
Does protection cover application-layer (L7) attacks?
Partially. Filtering mainly targets L3/L4. Sophisticated HTTP attacks often need complementary CDN/WAF.
Do all datacenters get the same level?
Mitigation network is global, but thresholds and options vary by offer (shared, VPS, bare metal, Game).
What if mitigation blocks legitimate traffic?
Document legitimate peaks, open a ticket, consider custom rules or higher tier (Game, e-commerce).
Next time an OVHcloud quote says “Anti-DDoS included”, ask: included against which attack type, on which IP, with what recourse if legitimate traffic is filtered?