Which CDN actually protects your site from DDoS attacks?

Cloudflare doesn't meter DDoS mitigation: it's unlimited on Free, Pro, Business and Enterprise, with no surprise charge on attack day. The WAF and a free managed ruleset are included even on the free plan. For most small sites, that's the whole answer for $0.

Where Free runs thin is rate limiting. You get one rule, counting over 10 seconds and blocking for 10 seconds. Pro gives you 2, Business 5. Spend your single rule on the login or search endpoint, where layer 7 attacks hurt most. On WordPress, add a firewall rule that blocks /xmlrpc.php: it's a favorite target and blocking it costs nothing.

Two gotchas from the forums. "I'm Under Attack" mode challenges every visitor for a few seconds and breaks RSS feeds and API clients, so use it during an attack, not as a default. And the stories of sites riding out huge attacks rarely come from free accounts: with no chat support and no SLA below Business, you're on your own at the worst moment.

Shield Standard protects availability, not your bill. It's free, always on and handles network-layer floods. On pay-as-you-go pricing, though, every request in a layer 7 attack is billed. One developer wrote up a $4,500 bill after a request loop; an AWS re:Post thread describes roughly $200 extra per month from suspicious traffic.

The flat-rate plans fix that. Free (1M requests, 100 GB, 5 WAF rules), Pro at $15 (10M requests, 50 TB, 25 rules), Business at $200 (125M requests, 50 TB, 50 rules), Premium at $1,000 (500M requests). No overage charges, even during attacks. Advanced DDoS protection starts at Business.

Above that, Shield Advanced costs $3,000 a month per payer account with a one-year commitment, plus data transfer fees. It adds the managed layer 7 DDoS rule and access to the Shield Response Team, which requires Business or Enterprise support. That's an enterprise purchase, not an SMB one.

Bunny.net charges for CDN by volume, from $0.01 per GB in North America and Europe, with a $1 monthly minimum. Protection comes from Bunny Shield, a layer you switch on per zone. Basic is free: a basic WAF ruleset, 2 rate limiting rules and simple bot detection, with a Bunny-branded block page.

The real threshold is Advanced at $9.50 a month: 10 rate limits, 10 custom rules and expert-managed DDoS rules. Business at $99 a month goes to 25 rules. Inspected requests are capped per plan and billed per million beyond that ($0.70 on Basic, $0.65 on Advanced), so watch that counter during a layer 7 attack.

Field reports are mixed. One user on maximum protection says not a single attack request reached the origin. A blog host, on the other hand, moved from Bunny to Cloudflare after Tor-based attacks, because useful filtering needed the paid tier. Bunny is a great CDN with excellent support and a security layer that keeps improving.

Azure Front Door comes in two tiers. Standard costs $35 a month as a base fee and covers delivery with basic security, including custom WAF rules. Premium costs $330 a month and bundles the managed WAF rules and bot protection: Microsoft states that WAF pricing is included in Premium. Data transfer is billed on top.

The jump from $35 to $330 is the whole story. The managed rulesets, the ones that block known attack patterns without you writing anything, only live in Premium. On Standard, you write your own rules.

Our take: it makes sense if your apps are already in Azure and your team knows the portal. For a standalone site, Cloudflare Pro gives you managed rules for a fraction of the price.

Sucuri is a website firewall first, with a CDN on top. It says it blocks layer 3, 4 and 7 DDoS attacks over an Anycast network. The firewall costs $9.99 a month on Basic and $19.98 on Pro, per site; multi-site setups go through sales.

The appeal is rules already built for WordPress: login pages, xmlrpc.php and vulnerable plugins are covered without writing a rule. If you don't want to learn firewall syntax, it's the shortest path.

The downsides show up in reviews: false positives that throw "Access Denied" on your own admin, and support that several users call slow. Allowlist your IP on day one, and price it against Cloudflare Pro, which covers every subdomain.

Gcore gives you the first TB of CDN traffic free each month, then €0.01 per GB up to 500 TB, no subscription. That's the best volume price in this comparison. Security is sold separately: the pay-as-you-go CDN doesn't list a WAF or layer 7 filtering as included.

The firewall is called NextGen WAF (WAAP), with Free, Start, Pro and Enterprise tiers billed per million requests, from €2 down to €1 ex. VAT, plus €10 per domain on Pro, which has a 30-day trial. For whole networks, layer 3/4 DDoS protection costs €3.90 per Mbps of clean traffic, and attack size doesn't change the bill.

Our caveat: the WAAP pricing table is hard to read and per-plan quotas need a sales question. Ask for a cost estimate on your real traffic first.

Fastly runs one of the fastest networks around, but its protection pricing is the hardest to predict. The DDoS Protection add-on includes 500,000 free requests a month, then costs $1 per 10,000 requests. In plain terms, the bigger the attack, the bigger that line can get, the opposite of Cloudflare or CloudFront flat-rate plans.

Next-Gen WAF has no public price. The CDN includes 100 GB and 1 million requests free per month per region, then $0.12 per GB in North America and Europe.

Our take: Fastly fits teams with a negotiated contract. For a small business, per-request DDoS pricing puts the attack risk on your invoice.