Identify the service you need to protect
DDoS attacks attempt to disrupt availability through malicious traffic or requests. Begin by describing your service: a website, API, mail service or another protocol. Website proxy protection and network-level mitigation can have different scopes. Confirm that the proposed product covers your actual protocol and traffic pattern; a plan described for websites should not automatically be treated as protection for every service on the server.
Understand the path to your origin
For a compatible proxy service, review how visitor traffic reaches the protected endpoint and then the origin server. Agree which DNS, certificate or firewall changes are required and who is authorised to make them. Exposing an unprotected route to the origin may undermine the intended design. Coordinate changes carefully so that legitimate services, administration and integrations remain reachable as intended.
Compare published limits and responsibilities
Check the number of protected domains or origin resources, supported features, configuration requirements and any published traffic or request limits. Clarify who monitors alerts and investigates blocked legitimate traffic. A self-managed protection licence requires an operator and compatible infrastructure; it is a different purchase from a configured remote protection service. Include your own server and licensing costs when comparing the alternatives.
Plan validation and incident communication
Record normal application behaviour before activation and validate key customer actions after configuration. Security testing needs authorisation from all affected parties; do not generate attack traffic as an informal test. Agree the reporting channel, information needed for investigation and any response targets in the service terms. Keep useful, redacted timestamps and request examples rather than sending passwords or unrelated customer data.
Keep protection in a wider operating plan
DDoS protection does not replace software updates, access controls, backups or application troubleshooting. Confirm the exact product capabilities and exclusions before ordering, and retain an escalation plan for incidents outside that scope. Nuberal can review the requirements for the published remote-protection services or a self-managed licence; availability and configuration are confirmed for the selected order.
DDoS background: Cloudflare Learning Center ↗
Your decision checklist
- Actual protocol and exposed resources
- Origin access and configuration ownership
- Published features, limits and exclusions
- Authorised validation and escalation route
