DDoS
Always-on L3 to L7 scrubbing, with premium transit-layer scrubbing for non-HTTP services.
What it is
Standard DDoS is included in every Shield plan. Premium transit-layer scrubbing handles arbitrary TCP/UDP services by advertising your prefix behind our anycast and scrubbing upstream. Reports are exportable for audit evidence.
When to use it
- Get DDoS evidence for compliance audits.
- Protect non-HTTP services (game, custom protocol).
- Front a high-value origin (payments, auth).
Quickstart
asc shield ddos transit enable --origin 1.2.3.4 --port 443 --proto tcpclient.shield.ddos.transit.enable(origin='1.2.3.4', port=443, proto='tcp')await client.shield.ddos.transit.enable({ origin: '1.2.3.4', port: 443, proto: 'tcp' });Limits & quotas
| Limit | Default | Burst | Notes |
|---|---|---|---|
| HTTP scrubbing capacity | >100 Tbps | — | Included |
| Transit scrubbing | $50 / Gbps-mo (commit) | — |
Pricing
See pricing. Pay-as-you-go, billed monthly via Stripe.
API surface
POST /v1/shield/ddos/transit/enable
Required scope(s): shield:write. See Scopes.
Security
All access is authenticated and scoped. See Auth & scopes and Network controls.