What happens to an unprotected server
Your server's IP address is effectively public: it's in your players' network logs, in server lists, in Discord messages. Anyone who has it can feed it to a booter — a web service that sells DDoS attacks by the minute, with entry plans around $5. There is no skill barrier and no meaningful deterrent. In practice that means the trigger is never "is my server important enough?" — it's any argument: a ban, a lost PvP fight, a griefing dispute, a rival community. What a booter actually is is worth understanding, because it explains why attacks on tiny servers are so common.
The three kinds of attack you'll face
| Volumetric floods (Layer 3/4) | Raw bandwidth — UDP/TCP garbage meant to saturate your host's pipe. Largest Arvoris has absorbed: 7.15 Tbps. Unprotected, your host null-routes you long before that. |
| Connection floods | Thousands of TCP connections opened and held to exhaust your server's connection slots. Cheap to send, brutal on Java servers. |
| Minecraft-protocol attacks (Layer 7) | Bots that speak valid Minecraft: ping spam that fakes your server list entry, join floods that fill slots with fake players. Generic filters see legitimate-looking traffic and pass it through. Arvoris has filtered a 50-million-connection L7 attack. |
Generic "DDoS protected" filtering handles part of the first category. The second and third require a filter that understands the Minecraft protocol itself — which is what Cryo and the antibot gauntlet do.
What downtime actually costs you
- Players don't come back. A player who hits "Can't connect to server" tries the next server on their list. Communities are built on momentum, and a weekend of outages during your growth phase can erase months of work.
- Trust breaks fast. "The server is always down" spreads through Discord faster than any apology. Staff burn out fielding the same questions during every attack.
- Attackers learn it works. An unprotected server that goes down once gets hit again — the attacker just proved a $5 purchase gives them power over your community.
- Ransom attempts follow. Some attackers demand payment to stop. Paying marks you as a target that pays.
Why plugins and in-server fixes can't help
Every anti-DDoS "solution" that runs on your own server shares one fatal flaw: it sits at the destination. A flood wins by overwhelming the path to your server — the bandwidth, the connection table, the host's upstream — all of which are exhausted before your plugin sees a single packet. Real mitigation reverses the geometry: players connect to a large anycast edge (Cloudflare Spectrum, 500+ Tbps across 330+ cities), attacks are absorbed and filtered there and on Arvoris' own network (AS216013, 600+ Gbps of Minecraft-aware Layer-7 filtering), and only clean traffic is forwarded to your backend. Your real IP is never published, so there's nothing to aim the booter at.
"I'll add protection when I get bigger" — the free plan removes that excuse
The old reason to delay was cost. That reason is gone: the Arvoris free plan is $0, covers up to 15 players, and includes the full mitigation pipeline — the same edge, the same Minecraft-aware filtering, and real player IPs via PROXY protocol, which most services gate behind paid tiers. Setup is one DNS record and roughly five minutes; there's no plugin and you keep your current host. If your server grows, paid plans run $10–40/mo. The only genuinely bad option is staying unprotected while your IP sits one angry player away from a $5 booter.
Common questions
Do small Minecraft servers really get DDoSed?+
Yes — small servers get attacked more often than big ones, because attackers are usually players you interact with directly: someone you banned, someone who lost a fight, a rival server owner. A $5 booter subscription is well within the budget of an angry teenager, and small servers rarely have any defense.
How much does it cost someone to DDoS my server?+
Booter (stresser) services sell attack time for roughly the price of a fast-food meal — entry plans commonly start around $5. The attacker pastes your IP into a web form and clicks a button. No skill, no botnet of their own, no risk they perceive as real.
Can a plugin protect my server from DDoS attacks?+
No. A plugin runs inside your server, at the end of your host's network connection. By the time flood traffic reaches the plugin, it has already saturated the pipe or exhausted connection slots — the resource the attack targets is upstream of anything a plugin can touch. Mitigation has to happen on someone else's network, before traffic reaches yours.
Isn't my host's DDoS protection enough?+
Usually not for Minecraft. Most hosts run generic Layer-4 filtering that stops crude floods but waves through bot attacks speaking valid Minecraft protocol — the attacks that actually empty servers. And when a large attack lands, many hosts null-route your IP, taking you offline themselves. See the [dedicated hosting guide](/guides/ddos-protected-minecraft-hosting) for details.
What does Minecraft DDoS protection cost?+
With [Arvoris](/minecraft-ddos-protection) it starts at $0: the free plan covers up to 15 players with the full mitigation pipeline and real player IPs. Paid plans run $10–40/mo. Setup is one DNS record, about five minutes, and you keep your current host.
Protect your server before the first attack, not after — create a free network and be behind the edge in about five minutes.