Vendors describe protection in terms of capacity, but the number that changes your architecture is not capacity — it is the delivery model. There are three in common use, and they differ in what you have to change, what they can inspect, and what happens when they fail.
Reverse Proxy
You point DNS at the provider. Their servers terminate the connection, inspect the request, and forward clean traffic to your origin. Because the proxy speaks the protocol, it can challenge clients, apply rules per URL, and cache. The cost is that it only protects what resolves through it: anything still reachable at the origin address bypasses the whole system.
Anycast Routing
The same address is announced from many locations, and the internet delivers each packet to the nearest one. Floods are spread across sites instead of concentrating on one, which is what makes very large volumetric attacks survivable. It works below the application layer, so it protects any protocol — but it cannot, by itself, tell a valid request from a malicious one.
GRE and Routed Protection
Your network advertises its prefixes through a scrubbing provider, which filters traffic and tunnels the clean remainder back to you. This is the model for organisations that own address space and need to protect non-HTTP services at scale. It requires network engineering on both sides and changes how your routing behaves under failure.
They are layers, not rivals
Large deployments usually combine them: anycast to absorb volume, a proxy to inspect requests, and routed protection for the services that do not speak HTTP.
What Each One Costs You
- TLS: a proxy terminates it, which means the provider holds a certificate. Routed protection does not, which keeps encryption end to end.
- Client addresses: behind a proxy, your logs show proxy addresses unless forwarded headers are read correctly — a common source of broken rate limiting and wrong geolocation.
- Latency: an extra hop is an extra hop. Well-placed edges usually pay for themselves in TLS termination closer to the user, but this is worth measuring rather than assuming.
- Failure mode: if a proxy is unreachable, your site is unreachable, even when the origin is healthy. Know what the provider does when its own edge fails.
Choosing
For a website or API, a reverse proxy is almost always the right starting point: it is a DNS change, it inspects the traffic that actually threatens you, and it can be rolled back in minutes. Move up the stack only when you have a specific reason — a non-HTTP protocol, your own address space, or a compliance rule about who may terminate your TLS.