What a Minecraft DDoS attack actually looks like
"DDoS" covers three very different problems for a Minecraft server, and a protection service has to solve all three:
- Layer 4 volumetric floods — raw UDP/TCP garbage measured in gigabits, meant to saturate your host's uplink. Your server never even sees it; the pipe just fills. Only networks with more capacity than the attack can absorb these.
- Layer 7 join floods (bot attacks) — thousands of fake clients speaking valid Minecraft protocol, joining faster than your server can tick. These pass straight through generic firewalls because every packet looks legitimate.
- Ping/MOTD spam — status requests at absurd rates that quietly eat your CPU and inflate your player-count metrics. Rarely fatal alone, almost always present.
Why generic protection fails Minecraft
Cloud firewalls and "game server protection" boxes filter on packet shape: source, rate, size. A Minecraft join flood is protocol-perfect traffic — correct handshake, plausible usernames, valid protocol versions. To stop it without kicking real players, the filter has to speak Minecraft: parse the handshake, evaluate the hostname, know the difference between a status ping and a login, and hold suspicious joins for verification instead of guessing.
That is exactly what Cryo, our Layer-7 mitigation engine, does. Volumetric floods die at the Cloudflare Spectrum anycast edge (500+ Tbps of absorption capacity across 330+ cities); everything that speaks Minecraft continues to our own network — AS216013, 600+ Gbps of filtering capacity — where Cryo parses the protocol itself. Suspicious joins are detoured into CryoLimbo, the verification gauntlet, and clean players pass to your backend with their real IP intact.
What to look for in a protection service
- Protocol-aware Layer 7 filtering — not just bandwidth. Ask how join floods are separated from real players.
- Real client IPs (PROXY protocol) — without it, every ban plugin on your server breaks. Arvoris includes it free.
- Anycast entry + regional PoPs — players should enter the network near where they live. See our locations.
- Published capacity you can verify — our front door is Cloudflare's publicly documented 500+ Tbps network, not a number invented for a landing page.
- Honest pricing — protection that starts free and scales with your player count, instead of quoting "from $300/mo" after a sales call.
What it costs
Every Arvoris plan — including the free tier — runs the full pipeline: anycast absorption, Cryo Layer-7 filtering, verification, AntiVPN and real client IPs. Paid tiers raise player caps and unlock control features: $10/mo for 60 players, $25/mo for 150, $40/mo for 500. The full comparison matrix is on the pricing page — no quote forms, no sales calls. Running a hosting company instead of a single network? There's a white-label track for that.
Common questions
Does DDoS protection add lag for players?+
Barely measurable, if it's built correctly. Players connect to the nearest edge PoP via anycast — often a shorter route than to your server directly — and the filtering happens inline at wire speed. On Arvoris, geo-steering plus MOTD edge caching typically adds under a millisecond of processing overhead.
Can I keep my current host?+
Yes. Proxy-based protection like Arvoris sits in front of any host. You change one DNS record; your server stays exactly where it is. There is no plugin and no migration.
Will I still see real player IPs?+
With PROXY protocol support — yes. Your proxy or server receives the original client IP with every connection, so bans and per-IP plugins keep working. Arvoris includes this on every plan, including Free.
How much does Minecraft DDoS protection cost?+
On Arvoris: $0 for up to 15 players, $10/mo for 60 players, $25/mo for 150, $40/mo for 500, and custom Enterprise above that. Every tier runs the identical mitigation pipeline — paid plans add capacity and control, not safety.
Ready to try it? Create a free network — one DNS record and you're behind the edge in about five minutes.