CDN DDoS Protection Pricing: Comparing Always-On, On-Demand, and Included Plans

I got a call at 2 AM back in 2019 because a client’s “included” DDoS protection plan stopped at 10 Gbps. They were getting hit with 40 Gbps and suddenly owed $18,000 for emergency mitigation. They thought they were covered, but they’d never read the fine print on what “included” actually meant. If you’re trying to make sense of DDoS pricing, you’re not alone — most teams don’t realize how different the protection plans are until they’re under attack.

The Truth Behind "Included" DDoS Protection

Almost every major CDN now advertises free or included DDoS protection, and for a lot of small sites, that’s genuinely enough. These plans typically cover network-layer attacks — your SYN floods, UDP amplification, and volumetric junk — up to a certain threshold. I’ve seen providers proudly list “unmetered DDoS mitigation” on their pricing page, then bury a fair-use clause that lets them null-route your traffic or force you onto an enterprise contract if you get attacked too often. It’s not malicious, it’s just how they keep costs predictable on their end.

What you really need to check is where that included protection stops. Does it cover application-layer (L7) attacks? Does it include a Web Application Firewall for those sneaky HTTP floods that look like real users? Most included plans don’t. They’ll soak up the big, dumb volumetric attack but they won’t help much when someone hammers your login page with 50,000 requests per second from a botnet that rotates user-agents. I learned this the hard way with an e-commerce client in 2021 whose checkout API went down despite having “DDoS protection” — the CDN filtered the L3/L4 flood but passed the L7 traffic straight through because they didn’t have rate limiting or bot management enabled.

That’s why it’s so important to map your protection to your actual bill. If your origin still pays for every byte the CDN pulls, even a mitigated attack can inflate your costs. I always tell teams to model this alongside their CDN Egress Cost Modeling: Understanding and Reducing Your Largest Bill Component so they know what happens when attack traffic hits their origin. An included plan might save you a monthly fee, but it won’t save you from egress overages if your caching strategy isn’t tight.

# Simple check: Estimate your exposure with "included" protection
# Assumptions: Included plan caps at 10 Tbps L3/L4, no L7 protection

monthly_requests = 500_000_000  # normal traffic
attack_rps = 25_000            # L7 HTTP flood (looks like normal traffic)
attack_duration_hours = 3

attack_requests = attack_rps * 3600 * attack_duration_hours
total_requests = monthly_requests + attack_requests

# Example pricing: $0.0075 per 10k requests after first 10M
billable_requests = max(0, total_requests - 10_000_000)
overage_cost = (billable_requests / 10000) * 0.0075

print(f"Attack added {attack_requests:,} requests")
print(f"Estimated overage: ${overage_cost:,.2f}")
print(f"Tip: Check if your plan bills for mitigated L7 requests")

Always-On vs On-Demand: Where Your Money Really Goes

When you move past included protection, you’ll run into two paid models: always-on and on-demand. They sound similar, but they bill completely differently, and picking the wrong one is one of the fastest ways to waste budget. Always-on means every single request is scrubbed through the provider’s mitigation stack — 24/7, whether you’re under attack or not. You pay a higher flat monthly fee, but you get instant mitigation with almost no detection delay. On-demand stays dormant until an attack is detected, then it diverts traffic through scrubbing centers. The monthly base is lower, but you’ll pay activation fees or burst charges when it kicks in.

I usually recommend always-on for anything that can’t tolerate even 60-90 seconds of downtime — think financial services, healthcare portals, or live ticketing. I worked with a gaming studio that tried to save $2,000 a month by choosing on-demand. When they got hit during a launch, the 90-second BGP reroute window was enough for players to get disconnected and flood support channels. The brand damage cost them way more than the savings. On the other hand, for a content blog or marketing site where a minute of slow loading isn’t catastrophic, on-demand is often the smarter financial choice. You’re trading a bit of reaction time for a much lower baseline DDoS cost.

The pricing structure for these protection plans also ties directly into how you buy bandwidth. Always-on providers often require you to commit to a bandwidth level to get a decent rate, while on-demand plans are more likely to be pay-as-you-go with a scary per-attack price tag. Before you sign, compare this with your CDN Bandwidth Commitment Pricing: When Committed Plans Save Money vs Pay-As-You-Go forecast. And don’t forget that L7 mitigation lives and dies on request pricing — if you’re paying per request, an on-demand activation during a large HTTP flood can spike your next invoice if the provider counts scrubbed requests as billable. Review your CDN Request Pricing Analysis: Reducing Per-Request Costs at Scale carefully and ask specifically: “Do you bill for requests you block?”

// Example: Cloud scrubbing cost comparison logic (simplified)
// See HTTP semantics for rate limiting: https://httpwg.org/specs/
// And caching best practices: https://web.dev/articles/

function estimateMonthlyCost(model, config) {
  const baseFee = model === 'always-on' ? 3000 : 800;
  const scrubbingFee = model === 'always-on' ? 0 : 2500; // per activation
  const includedMitigationTB = model === 'always-on' ? 100 : 10;

  let scrubbingCost = 0;
  if (config.attackSizeTB > includedMitigationTB) {
    // On-demand often charges per TB over included threshold
    const overageTB = config.attackSizeTB - includedMitigationTB;
    scrubbingCost = model === 'always-on' ? overageTB * 50 : overageTB * 150;
  }

  if (model === 'on-demand' && config.attacksThisMonth > 0) {
    scrubbingCost += scrubbingFee * config.attacksThisMonth;
  }

  return baseFee + scrubbingCost;
}

// Scenario: 2 attacks, 25TB each
console.log('Always-On:', estimateMonthlyCost('always-on', { attackSizeTB: 25, attacksThisMonth: 2 }));
console.log('On-Demand:', estimateMonthlyCost('on-demand', { attackSizeTB: 25, attacksThisMonth: 2 }));

What DDoS Protection Actually Costs at Different Attack Scales

Let’s talk real numbers, because vendors love to be vague here. From what I’ve seen across negotiations in the last few years, pricing falls into pretty clear buckets based on attack size and frequency. A small site that just needs basic L3/L4 coverage can often stay on an included plan forever. Once you start seeing regular L7 attacks or need guaranteed uptime with an SLA, you’re looking at $800 to $3,500 per month minimum for a proper paid plan — and that’s before overages.

The painful part isn’t the base fee, it’s the overage model. Some providers charge by clean bandwidth delivered, others charge by mitigated attack volume, and the worst ones charge for both plus a per-request fee for L7 filtering. I’ve seen a $1,500/month on-demand plan turn into a $12,000 bill after a single weekend of sustained 20 Gbps attacks with 15k RPS on the application layer. That’s why you need to ask for their pricing table in writing: What’s included, what’s metered, and what triggers an automatic upgrade to enterprise pricing? Don’t rely on the marketing page.

For teams just getting started, my advice is to document your normal traffic baseline first — requests per second, 95th percentile bandwidth, and origin egress — then compare that against the thresholds in the table below. If your normal peak is 500 Mbps and the included plan covers 10 Tbps, you’re probably fine for now. But if you’re already running 2-3 Gbps at peak and you handle sensitive transactions, the jump to always-on starts to make financial sense because you avoid those unpredictable activation spikes. This is the core of always-on vs on-demand decision making: predictable cost versus lower base cost with burst risk.

Putting It Into Practice: Building a Cost-Aware Mitigation Stack

You don't need to pick a single pricing model and live with it. We've seen the best cost-to-protection ratio comes from layering: use "included" baseline protection for L3/L4 volumetric noise, add cheap edge rate-limiting for L7 abuse, and reserve on-demand scrubbing for true 100+ Gbps events. That way you're not paying $3,500/month for always-on scrubbing when 92% of months you see nothing bigger than a 2-3 Gbps UDP reflection that Cloudflare, Akamai, or Fastly would have absorbed anyway.

The trick is automating the failover so you’re not manually flipping DNS at 2 a.m. during an attack. A common pattern is to front your origin with Anycast + aggressive caching, enforce token-based rate limits at the edge, and trigger a scrubbing-center redirect only when your edge 5xx rate or packets-per-second crosses a threshold. This is where you’ll save real money — running those edge functions 24/7 costs pennies compared to always-on clean traffic fees. If you're already optimizing where logic runs, check out CDN Edge Compute Cost Optimization: Function Pricing Models and Efficiency Tricks — moving that rate-limit check from origin to edge typically drops compute spend from $0.60 per million requests to under $0.12.

# Terraform: Cost-aware rate limiting + on-demand scrubbing trigger
# Baseline L7 protection is cheap; scrubbing is triggered only when needed

resource "cloudflare_rule" "baseline_l7_shield" {
  zone_id     = var.zone_id
  description = "Block L7 abuse before it hits origin - costs ~$0.05/10k req"
  expression  = "(http.request.uri.path contains \"/api/\" and ip.geoip.asnum ne 0)"
  action      = "managed_challenge"
  # Anomaly-based: 30 r/s per IP, burst 50 - tuned from real logs
  ratelimit {
    characteristics = ["ip.src"]
    period          = 60
    requests_per_period = 30
    mitigation_timeout  = 600
  }
}

resource "cloudflare_notification_policy" "scrubbing_trigger" {
  name        = "auto-scrubbing-trigger"
  description = "Alert + auto-route to scrubbing center if > 50k rps or > 10 Gbps"
  enabled     = true
  alert_type  = "ddos_attack_l7"
  filters {
    threshold_rps  = 50000
    threshold_gbps = 10
  }
  # Webhook to your automation that CNAMEs to on-demand scrubbing (e.g., Akamai Prolexic, AWS Shield Advanced)
  mechanisms {
    webhooks = [var.pagerduty_webhook_id]
  }
}

Advanced Patterns and Troubleshooting When the Bill (or Traffic) Spikes

Here's where teams get burned: you chose on-demand to save $36k/year, then you eat a 1.4 Tbps carpet-bombing attack and get a $18,000 overage invoice for 42 TB of scrubbed traffic at $0.08/GB. Or the opposite — you paid for always-on and your logs show the provider mitigated exactly 11 Gbps of junk last quarter that the "included" plan would've covered free. We always tell clients to ask for the clean traffic vs mitigated traffic breakdown. If more than 95% of mitigated traffic is under 10 Gbps and under 50k rps, you're over-provisioned. Downgrade to included + on-demand and put the savings into better observability.

Another pattern we use for high-risk e-commerce and gaming customers is reserved scrubbing capacity. Think of it like EC2 Reserved Instances — you commit to 20 Gbps of scrubbing for 12 months at ~$1,200/month instead of $3,500 on-demand, and you still burst to 500 Gbps when needed. It cuts the 95th-percentile bill by 40-60% if you know you'll get hit quarterly. This pairs well with CDN Reserved Capacity Pricing: Locking In Rates for Predictable Workloads — you can often bundle the DDoS commitment with your bandwidth commit and get another 15-20% off list price. Just don't reserve more than your 6-month peak attack; we've seen teams lock in 100 Gbps and only ever use 8.

If your bill spikes without a reported attack, check these three things first: 1) Origin fetch amplification — a 1 MB attack payload that bypasses cache can turn into 50 GB of origin egress if you don't have CDN Storage Cost Optimization: Tiering, Compression, and Lifecycle Policies and origin shield configured. 2) False positives from aggressive WAF managed rules blocking legit traffic and forcing retries — that's often billed as protected requests. 3) Log delivery fees — some vendors charge $0.15/GB for DDoS telemetry logs. Turn sampling to 1:1000 outside of attacks; you don't need full-fidelity for months of clean traffic.

Frequently Asked Questions