Every free option, honestly compared
| Host-included filtering | Free with hosting. Generic Layer-4 only — stops crude floods, blind to Minecraft-protocol bot attacks, often ends in a null-route |
| Cloudflare free plan | HTTP/HTTPS only. Cannot proxy raw TCP game traffic without Spectrum (enterprise). Doesn't work for Minecraft at all |
| Anti-DDoS plugins | Free, but run on the machine under attack — no help against volumetric floods, limited help against bots |
| Free tiers of protection services | The only category that actually filters game traffic off-server for $0 — check limits and whether real IPs are included |
| Arvoris Free | Full pipeline: anycast edge, Minecraft-aware L7 filtering, PROXY protocol real IPs. 15 players, 1 backend, no card |
Why most free protection fails for Minecraft specifically
Minecraft is a persistent raw-TCP protocol, which rules out the web-focused free tools most people reach for first. And the attacks that actually kill servers aren't always giant floods — they're join floods and bot waves speaking perfectly valid Minecraft protocol. Filtering those requires a mitigation layer that parses handshakes, status pings and logins, which generic host protection and web CDNs simply don't do. That's the gap protocol-aware protection exists to fill.
The free route that gives you the full pipeline
The Arvoris Free plan puts the same stack in front of your server that paid plans use: players enter Cloudflare Spectrum's 500+ Tbps anycast edge at the nearest of 330+ cities, traffic is filtered by Cryo — a hostname-aware Layer-7 engine built for Minecraft — on Arvoris' own network, and clean connections are forwarded to your backend with real player IPs via PROXY protocol. The free limits are player count and analytics depth, not protection quality.
Set it up in about five minutes
- Register at beta-panel.arvoris.net — no card required.
- Create a network and set your server's address (for example `203.0.113.7:25565`) as the backend. Any host works — you keep it.
- Point your DNS: one CNAME (or SRV for a custom port) from `play.yourdomain.com` to your assigned edge endpoint.
- Optionally enable PROXY protocol on your proxy or Paper server so bans see real IPs — guides for BungeeCord and Velocity cover the one-line config.
- Hide the old IP: once traffic flows through the edge, remove public DNS records that expose your backend.
When free stops being enough
Fifteen concurrent players covers an SMP with friends or a community just getting started. Past that, paid tiers scale the same pipeline: Budget at $10/mo for 60 players with tunable antibot, Essential at $25/mo for 150 players with the full verification gauntlet, Value at $40/mo for 500 players and multi-backend routing. Nothing about your setup changes when you upgrade — same DNS record, same panel.
Common questions
Is there really free DDoS protection for Minecraft servers?+
Yes. Some protection services, including Arvoris, run a genuinely free tier: the Free plan gives you the complete mitigation pipeline — 500+ Tbps anycast absorption, Minecraft-aware Layer-7 filtering and real player IPs — for up to 15 players, one backend, no card required.
Can I use normal free Cloudflare to protect my Minecraft server?+
No. Cloudflare's free plan proxies HTTP/HTTPS websites only. Minecraft is raw TCP on port 25565, which needs Cloudflare Spectrum — an enterprise product you can't buy on a free personal plan. An orange-clouded DNS record for a Minecraft server simply won't connect. Arvoris is built on Spectrum, which is how it exposes that capacity at $0.
Isn't my host's included DDoS protection enough?+
For crude volumetric floods, sometimes. But host filtering is generic Layer-4 — it can't tell a real player from a bot speaking valid Minecraft protocol, so join floods walk straight through. And when an attack gets big, many hosts null-route your IP, taking you offline anyway.
What's the catch with the Arvoris Free plan?+
The limits are the catch, and they're published: 15 concurrent players, 1 backend, 1,000 AntiVPN queries and 24-hour analytics retention. The mitigation itself is not cut down — filtering, real IPs via PROXY protocol and the anycast edge are identical to paid plans. Outgrow it and Budget is $10/mo for 60 players.
Do free anti-DDoS plugins work?+
A plugin runs on the server the attack is trying to overwhelm, so it can only act after hostile traffic has already consumed your bandwidth and CPU. Plugins are fine as a last-line antibot layer, but they cannot absorb a volumetric attack — that has to happen on someone else's network, before packets reach you.
If you're weighing options beyond free, the guide to choosing Minecraft DDoS protection covers what to look for at every budget.