Shield M
€10,99 EUR / mo
Vanilla or Paper, a small world, a handful of friends.
- 2× vCPU · Ryzen 9 9950X
- 2 GB DDR5 RAM
- 40 GB NVMe SSD
- Port 25 Gbps shared 8 TB fair use (outbound)
- Advanced DDoS protection
- 1× IPv4 address
- IPv6 /64 included
Minecraft DDoS protection
Two attacks that look nothing alike
Minecraft is TCP, which changes the shape of the problem compared with the UDP games. There is a real handshake at the transport layer, so the classic volumetric attack is a SYN flood: connection attempts that never complete, arriving fast enough to exhaust the table your server keeps them in.
The second kind is more interesting and more common against servers people care about. An attacker speaks the Minecraft protocol correctly. Status pings and login attempts arrive that are structurally valid, at a rate your server dutifully tries to service. Bandwidth stays unremarkable. The server stalls anyway, and everyone online is timing out while your monitoring says the link is fine.
A filter that only counts bits per second sees the first attack clearly and misses the second entirely.
What Minecraft DDoS protection actually filters
Every packet aimed at our range crosses the scrubbing layer before it reaches a customer machine, and on Shield that runs continuously rather than after a trigger. The Java Edition profile is protocol-aware: it understands the handshake, so a connection that cannot complete one properly is dropped at the edge instead of occupying a slot in your server’s connection table.
That is the part worth paying for. Dropping a bad handshake at the edge costs us a fixed amount of work per packet, and it costs your server nothing, because the packet never arrives.
The profile covers Java Edition servers and the proxies in front of them, including Velocity, BungeeCord and Paper. If you run a network, the proxy is the exposed surface and the only thing that needs the Shield address.
Bedrock, and other things we do not have a profile for
Our named Minecraft profile is Java Edition. Bedrock is a different transport and does not have its own profile, so it gets the universal baseline instead: source validation, rate limiting, and per-port lockdown that drops everything on ports you have not declared. That is a meaningful floor rather than a specific filter, and the difference is worth knowing before you buy rather than during an incident.
The same applies to anything on the box that is not the game. A Dynmap instance or a management panel you have exposed is web traffic, and it is protected as web traffic rather than by the Minecraft profile.
Sizing it
Minecraft is far more sensitive to single-core speed and to memory than to core count, so size on memory first and treat storage as the second question.
The detail that catches people is that the number on the plan is not the number you give Java. The JVM needs room outside its own heap, so -Xmx wants to sit roughly 1 to 1.5 GB under the machine’s total. Hand a 2 GB box all 2 GB and the kernel’s OOM killer ends your server for you, usually at the worst moment. On 8 GB you are comfortably giving Java 6.5 GB, which is a different server from the one that number suggests.
Mods change the arithmetic rather than adding to it. A large modpack can want more memory with ten players on it than vanilla wants with eighty, so the player count on its own tells you very little.
The machines and the filtering are both in the Frankfurt metro, which is the right region for players across Central Europe and the wrong one if your community is mostly North American. If you are standing a server up from scratch, the Paper on Debian 13 walkthrough covers the build, and how DDoS protection works covers the filtering in general rather than the Minecraft-specific part.
Sources
- The Minecraft wiki's dedicated server table lists 2 GB of RAM for one to three players and 8 GB for eight or more, and puts the JVM floor at 1 GB with 50-100 MB per player. source checked 2026-08-08
shield plans
What Minecraft needs
Pricing in EUR · 20% Austrian VAT for AT consumers · Reverse charge for EU B2B
The Minecraft wiki puts a dedicated Java server at 2 GB for one to three players and 8 GB once you are past eight, on top of a 1 GB floor for the JVM itself and roughly 50 to 100 MB per player after that. Mods and a busy world push it well past those numbers.
Shield XL
€29,99 EUR / mo
A public server or a large modpack, with JVM headroom to spare.
- 4× vCPU · Ryzen 9 9950X
- 8 GB DDR5 RAM
- 100 GB NVMe SSD
- Port 25 Gbps shared 20 TB fair use (outbound)
- Advanced DDoS protection
- 1× IPv4 address
- IPv6 /64 included
Shield XXL
€54,99 EUR / mo
A proxy network, or a modpack that wants 12 GB of heap on its own.
- 6× vCPU · Ryzen 9 9950X
- 16 GB DDR5 RAM
- 150 GB NVMe SSD
- Port 25 Gbps shared 35 TB fair use (outbound)
- Advanced DDoS protection
- 1× IPv4 address
- IPv6 /64 included
Every tier carries the same always-on filtering and the same 25 Gbps uplink, so the choice above is about compute, not about protection.
Frequently asked questions
Does the filtering understand a Velocity or BungeeCord setup?
Yes. The profile is protocol-aware rather than tied to one server implementation, and proxies are the normal case it sees, because a proxy is usually the only thing you expose. Put the proxy on the Shield IP and keep your backend servers on an internal address, which is the setup you want for other reasons anyway.
Does this stop bot joins, or only bandwidth attacks?
Both, and they are different problems. A volumetric flood is countable and shows up on a graph. Bot joins speak the protocol correctly and arrive at a rate your server tries to honour, so the bandwidth chart stays boring while the server stalls. Validating the handshake at the edge is what separates the two, and it is the part a plain bandwidth number tells you nothing about.
Is Bedrock Edition covered?
Not by a named profile. Our Minecraft profile is Java Edition, which is TCP. Bedrock runs over UDP and falls to the universal baseline: anti-spoofing, rate limiting and per-port lockdown. That is real protection and it is less specific than what Java gets, so we would rather say so than let you find out during an attack.
Do I still need a whitelist or an anti-bot plugin?
They solve an overlapping problem one layer up, and they are worth keeping. Edge filtering drops what never had a valid handshake. A plugin can act on accounts that connect legitimately and then behave badly, which is not something a packet filter can judge. Neither one replaces the other.
Is a Standard VPS enough for a small Minecraft server?
For a private server among friends, often yes. Filtering on the Standard line is reactive, with roughly a five second window before it engages, and for a small survival world a brief disconnect is survivable. Once you have a public server with a reputation to keep, that window is the whole problem, and Shield is the line that has no window.
Will the filtering interfere with a large modpack or big world downloads?
Modded traffic is still the same protocol, so the profile treats it the same way. Sustained high-throughput transfers, backups pulled off the box or a very large initial world sync can look like attack traffic to automated detection, which our terms state openly. If you have a big transfer planned you can tell support in advance and the sensitivity can be adjusted within limits.