Hetzner DDoS Protection

What Hetzner DDoS Protection actually is

Hetzner DDoS Protection is not a product you order, configure, or get billed for. It is network-level attack mitigation that Hetzner Online applies to traffic headed for any Hetzner service — cloud servers, dedicated root servers, web hosting, load balancers. In our view that framing matters, because our database originally carried it as a standalone firewall/DDoS product with its own launch date and feature flags, and that framing overstates what a buyer actually chooses. You do not select Hetzner because of this service; you get it because you selected Hetzner, and whether it is enough is a real question we work through below.

What happens technically, per Hetzner's own description of the system, is a three-layer process. First, automated recognition: the system watches traffic and packet volume, but also classifies attack type — Hetzner's example is that a 500k pps UDP flood is harmless to a server while a 500k SYN packet load can be a genuine problem, and the detection distinguishes between them. Second, traffic scrubbing for known attack patterns: DNS reflection, NTP reflection, and UDP floods on port 80 are filtered out at the scrubbing stage. Third, challenge-response authentication and dynamic filtering for the harder cases: SYN floods, DNS floods, and malformed packets, with filters adapted per attack. Hetzner states it runs Arbor and Juniper hardware for this, and its technicians continuously tune the responses after analyzing attacks.

The newest layer is the one we find most interesting. In March 2026 Hetzner announced it had deployed Nokia Deepfield Defender across its European data center infrastructure after extensive testing. That system detects attacks using IPFIX IE315 uncached traffic samples (an IETF-standard flow format, which is a genuinely fast signal compared with post-hoc traffic accounting), and it mitigates at the peering edge on Hetzner's Juniper routers via BGP Flowspec and NetConf. Attacks too complex for edge filtering get redirected to Nokia's 7750 Defender Mitigation System for cleaning. The important operational detail: the whole thing is zero-touch. Nokia explicitly describes it as eliminating the need for threshold lists or manually configured traffic baselines — the machine learning models adapt on their own.

Pricing: what you really pay

Zero. Hetzner states plainly on its DDoS page that the protection has not caused costs or prices to increase and is available to all customers. There is no scrubbing fee, no per-gigabit charge during an attack, no basic/premium tier, and no upsell path. For anyone who has priced dedicated mitigation — cloudflare-class network products, Arbor-based appliances, scrubbing-center contracts — the absence of a per-gigabit bill during an attack is the single biggest practical advantage here. A sustained volumetric attack against a cheap Hetzner box costs you nothing extra.

What you do pay is an implicit trade-off: because there is nothing to buy, there is nothing to tune. There is no per-customer mitigation capacity commitment, no published attack-size ceiling, and no dashboard where we could find configurable detection thresholds. The Nokia deployment is explicitly designed so nobody configures thresholds. If your business needs a contractual mitigation guarantee (for example a gaming platform whose revenue stops when the service stops), the free bundled protection is not a substitute for a mitigation contract — it is a baseline you build on.

Performance & infrastructure

The mitigation sits inside Hetzner's own network rather than in front of it at a third party, and that has concrete consequences. Detection and most filtering happen at the peering edge before attack traffic traverses the backbone, so ordinary customer traffic is usually untouched — Hetzner describes its mitigation as dynamic and says normal traffic is typically not affected. Only the complex application-layer residue goes to the dedicated mitigation system. Keeping filtering in-network also keeps packet handling under German and Finnish data protection rules, which matters to the GDPR-focused workloads that disproportionately choose Hetzner.

The underlying network is substantial: Hetzner publishes a total bandwidth of 50.12 Tbit/s across a redundant Juniper-routed backbone, with data center parks in Nuremberg and Falkenstein (Germany) and Helsinki (Finland), all ISO 27001:2022 certified. Nokia's announcement specifically calls out protection for GPU servers and HPC clusters, which tracks with Hetzner's current push into AI infrastructure — the same edge mitigation covers a €614/month AX162 bare-metal box and a small cloud instance alike, since it operates at the network layer rather than per product.

One caveat on coverage. The Nokia deployment as announced covers Hetzner's European data centers. Hetzner runs US (Ashburn, Hillsboro) and Singapore capacity for cloud products in colocation space it does not own, and its own docs contain a question about whether the DDoS system there is identical to the European one — we could not confirm the answer from official documentation, so we treat non-EU coverage as unverified rather than assumed.

Where it falls short

Start with scope: it only protects Hetzner infrastructure. If you run a mixed estate or a CDN in front, this does nothing for your non-Hetzner origin, and a serious DDoS strategy for most public-facing products still means a filtering layer in front of the origin (we would normally pair Hetzner with Cloudflare or similar for anything L7-heavy).

Second, the controls you get are essentially none. That is a design decision, not an omission — but it means you cannot whitelist, tune sensitivity, or see attack telemetry beyond what support shares. Teams coming from a dedicated mitigation vendor will notice the missing knobs immediately. There is also no WAF: application-layer attacks get volumetric and protocol filtering plus challenge-response, which is not the same as rule-based request inspection.

Third, transparency. Hetzner does not publish mitigation capacity figures, detection-time SLAs, or any uptime/credit commitment tied to the DDoS service, and we found no product-specific SLA for it at all. For a free inclusion that is defensible; for planning purposes it means you are trusting the vendor's operational competence rather than a contract.

Finally, one honest footnote from community history: long-running forum and Hacker News threads describe Hetzner null-routing attacked dedicated-server IPs and notifying the customer — i.e. keeping the rest of the network clean by disconnecting the target. Those reports predate the Nokia deployment by many years, and we could not verify the current policy from official pages. We flag it not as a confirmed practice but because it is the risk asymmetry of free protection: the mitigation is tuned for Hetzner's network health first, your workload second.

Who should pick this

Every Hetzner customer already has it, so the real question is when it is enough on its own. In our view it is adequate as the only DDoS layer for internal tools, APIs with authenticated clients, backend workers, and small public sites where an hour of degraded service during a rare attack is survivable. Those workloads get real volumetric protection at no cost and no operational burden.

We would add an external layer — a reverse proxy/CDN with L7 filtering, or a paid mitigation service — for anything where attacks are a plausible business threat: game servers, public web applications exposed to unauthenticated traffic, gambling/adtech endpoints, or any service a competitor or disgruntled user might target. In those cases Hetzner's edge filtering still absorbs the volumetric component for free, which is a genuinely good deal as a first stage even when you are paying someone else for the second. In operational terms we treat this as insurance against network noise rather than a security control: it buys time during a volumetric attack so your own filtering and your application can keep working. Plan for the incident anyway — an out-of-band status channel and a documented escalation path to Hetzner support cost nothing, and they matter more than any detection threshold you cannot set.

Key takeaways

• Automatic, network-level DDoS mitigation is included at no cost with every Hetzner product — no scrubbing fees, no per-gigabit charges during attacks.
• Arbor/Juniper filtering since years, upgraded in March 2026 with Nokia Deepfield Defender: edge detection via IPFIX sampling, BGP Flowspec mitigation on Juniper routers, complex attacks cleaned on Nokia 7750 systems.
• Zero-touch by design: no configurable thresholds, no per-customer dashboard, no WAF — which is either simplicity or a limitation depending on your threat model.
• Covers Hetzner infrastructure only (cloud, dedicated, web hosting); non-EU locations (Ashburn, Hillsboro, Singapore) are not confirmed to run the same stack.
• No published mitigation capacity, detection SLA, or credits; historical community reports of null-routing during attacks could not be confirmed against current official policy.
• Our view: strong free first stage for most workloads; pair with an external L7 filter or paid mitigation service when attacks are a plausible business risk.

Sources

• https://www.hetzner.com/unternehmen/ddos-schutz/
• https://www.hetzner.com/pressroom/nokia-network-security/
• https://www.hetzner.com/unternehmen/
• https://docs.hetzner.com/robot/dedicated-server/firewall/
• https://docs.hetzner.com/cloud/general/locations/
• https://news.ycombinator.com/item?id=6577465