Always-on vs reactive DDoS protection
The difference is when filtering starts, not how good it is
Both models drop the same kinds of traffic. The question is what happens in the seconds before anything is dropped at all.
Reactive mitigation runs a detector. It samples traffic, decides an attack is under way, and then routes you through filtering. Every step is sound engineering and it is what most VPS hosts include for free, ours included. But the detector needs enough evidence to fire, and gathering evidence takes time. On our Standard VPS line that is roughly five seconds.
Always-on filtering skips the detector. Every packet crosses the scrubbing layer whether or not anything is happening, so there is no decision to wait for and no state to transition through. That is the entire difference, and it is why the two are separate products rather than two speeds of one.
Five seconds costs nothing, or costs everything
Whether the window matters comes down to a single property of what you are running: is the connection stateful.
For a website, five seconds of packet loss means some requests fail and get retried. Visitors see a slow page. Almost nobody notices, and nobody files a ticket. Reactive protection is genuinely the right choice here, and paying for always-on would be paying for nothing.
For anything holding a live session, the same five seconds is a disconnect. Game clients time out well inside that window. Every player on the box drops at once, the match ends, and they reconnect into a server that lost its state. A voice server empties. A checkout flow abandons carts that were mid-payment. The outage is the same length; the cost is not remotely the same.
That is the actual decision. Not “how much protection do I need” but “does a five second interruption cost me anything”.
Reactive only sees layer 3 and 4
The last difference is a capability gap rather than a timing one.
Reactive mitigation operates on volume and packet characteristics, which is layer 3 and 4. It cannot inspect application protocol behaviour, so a layer 7 attack that speaks your game’s protocol correctly does not look like an attack to it. The bandwidth graph stays flat while the server falls over.
Filtering that class of traffic means holding a model of the protocol, which is what the 28+ Shield profiles are. Reactive filtering does not have one and cannot be given one. If layer 7 is your exposure, the timing argument is beside the point.
Which one you actually need
Run reactive if you are hosting a website, a blog, an API where retries are cheap, or anything where a slow moment is the worst outcome. It is included on every Standard VPS and it is enough.
Run always-on if you are hosting a game server, a voice server, a live checkout, or anything with a real time session that a five second loss would end. That is the Shield line.
If you are not sure which describes you, the useful question is not about attack sizes. It is whether a five second interruption right now would cost you players, money, or a ticket. If it would, the detection window is the product difference you are buying away.
Frequently asked questions
How long is the reactive detection window in practice?
On our Standard VPS line it is roughly five seconds from the attack starting to filtering engaging. That number varies by provider and by attack shape: a sudden volumetric flood trips detection faster than an attack that ramps slowly, and a slow ramp is exactly how someone avoids tripping it at all.
Does a five second gap really matter?
It depends entirely on whether your protocol is stateful. HTTP is not: a request that fails gets retried and the visitor sees a slow load. A game server session is: five seconds of loss is a timeout, so every connected player drops at once and reconnects into a broken match. Same outage, completely different cost.
Is always-on protection slower than reactive?
Not meaningfully on our stack, because the filtering is an XDP program running at the edge rather than a userspace proxy. The latency cost people actually notice comes from hauling traffic to a scrubbing centre in another country and back. Ours filters in the same facility the server is in, in Langen.
Which of your plans are reactive and which are always-on?
The Standard VPS line is reactive. The Shield line is always-on, and every Shield tier from S to Pro gets identical mitigation and the same profile list. Moving up a Shield tier buys CPU, RAM and disk, not a better class of filtering.