The question that decides everything: where does the fight happen?
Anti-DDoS and antibot tools all claim to stop the same attacks. What actually separates them is where they sit relative to your hardware. Anything that runs on or behind your server is already on the wrong side of the wire — by the time it sees an attack, the attack has already cost you bandwidth, connection slots, threads, and CPU. Protection only works if the attack dies *before* it reaches your box. That's the whole case for the edge.
The bandwidth math no plugin can win
Start with the simplest case, because it defeats every server-side tool at once: if your server has a 10 Gbps uplink and the flood is 11 Gbps, you are offline — full stop. It doesn't matter how clever your antibot plugin is or how tight your firewall rules are; the packets never even arrive to be inspected, because the pipe is already full. The only thing that keeps you online is a network with *more absorption capacity than the attack*, sitting in front of you. That is not something you can install on your box — it's a property of where the traffic lands. For scale: Arvoris routinely mitigates 100–200 Gbps floods of real Minecraft traffic with the origin never noticing, on a network that has absorbed volumetric attacks up to 7.15 Tbps.
Server-side antibot plugins: fighting after you've already paid
A plugin runs inside your server's JVM. For it to filter a bot, the bot's connection must first reach your host, open a socket, consume a thread, and often complete a login — all before your plugin's logic executes. On a calm server that's fine for blocking the occasional alt. Under a real join flood of tens of thousands of connections per second, your server is saturated before the plugin runs at all. The fight was lost at "connection accepted."
Firewalls: they can't read Minecraft
An OS firewall (iptables) or a cloud firewall filters on packet shape — source IP, port, rate, size. That stops crude Layer-4 floods of malformed garbage. But a Minecraft bot attack is protocol-perfect Layer-7 traffic: a valid handshake, a plausible username, a real protocol version. To a firewall it is indistinguishable from a legitimate player connecting. A firewall is good host hygiene; it is not a Minecraft defense.
In-host / provider DDoS protection: generic scrubbing and null routes
Your host's upstream "DDoS protection" is usually generic Layer-4 scrubbing tuned for web and generic TCP. It doesn't parse the Minecraft protocol, so join floods and ping spam sail through it. Worse, when a Layer-7 attack does bite, the common provider response is a null route — your server is pulled offline to protect the shared node, which finishes the attacker's job for them. And because you connect directly, your origin IP is exposed, so the next attack knows exactly where to aim.
Edge protection: the attack dies before your hardware sees it
Edge protection moves the fight off your machine entirely. With Arvoris in front, players connect to an anycast edge, not to your server. Volumetric floods are absorbed across 500+ Tbps of Cloudflare Spectrum capacity. Cryo, our hostname-aware Layer-7 engine, parses the Minecraft protocol on our own network (AS216013) and drops what isn't real. Suspicious joins are held in the CryoLimbo verification gauntlet until they prove human. Only clean players are forwarded to your backend — with their real IP intact via PROXY protocol, so your bans and plugins keep working. Your hardware never allocates a socket for an attacker.
Side by side
| Server-side plugin | Acts only after the bot already cost you a slot, thread and login — overwhelmed under a real flood |
| OS / cloud firewall | Layer-4 only; a valid-protocol join flood passes straight through as "players" |
| Host / provider DDoS | Generic Layer-4 scrubbing; null-routes under Layer-7; leaves your origin IP exposed |
| Edge protection | Attacks parsed and dropped before your hardware; origin hidden; real IPs preserved |
So do you still need a plugin or a firewall?
Yes — as complements, not as your DDoS defense. Keep a firewall for basic host hygiene and a plugin for in-game moderation logic (chat filters, command limits, punishments). They do jobs the edge doesn't. What changes is that neither is load-bearing for attacks anymore: with the edge in front, the flood never reaches the firewall or the plugin in the first place. See exactly how the pipeline drops an attack, stage by stage.
Common questions
Can a Minecraft plugin stop a DDoS attack?+
No. A plugin runs inside your server, so it can only act after the traffic has already reached and loaded your hardware. Volumetric floods saturate your uplink before the JVM runs a single line of code, and a large join flood exhausts your connection and login capacity faster than a plugin can respond. Plugins are for in-game moderation, not DDoS defense.
Doesn't my firewall already protect me?+
A firewall filters on packet shape — source, port, rate, size — which stops crude Layer-4 floods but is blind to Layer-7 Minecraft attacks. A bot join flood is valid protocol traffic: correct handshake, plausible usernames. The firewall can't tell it apart from real players. Separating those needs protocol-aware filtering at the edge.
Is my host's built-in DDoS protection enough?+
For raw volumetric attacks it helps, but it's generic scrubbing that doesn't understand the Minecraft protocol — so join floods and ping spam pass through, and under Layer-7 pressure hosts commonly null-route you (take your server offline) to protect the shared node. It also leaves your origin IP exposed for the next attack.
Does edge protection replace my antibot plugin?+
For attack defense, yes — the edge handles floods and bots before they reach your server. You can keep a plugin for in-game rules like command-spam limits or chat filters, but the heavy lifting moves off your hardware entirely.
Will edge protection lower my server's CPU load from bots?+
Directly. Bots are verified or dropped at the edge PoP, so they never open a connection, spawn a thread, or trigger a login on your box. Your CPU only ever serves players that already proved they're real.
The whole pipeline — anycast absorption, Cryo filtering, verification, AntiVPN and real IPs — runs on every plan, including the free tier. Put it in front of your server in about five minutes and move the fight off your hardware for good.