Capacity is the headline number in every DDoS datasheet, and it is close to meaningless in isolation. It describes the largest attack the provider could theoretically absorb across their whole network, not what they will do with yours. The useful questions are duller and much more predictive.
Questions Worth Asking
- How does mitigation start — automatically, or after a human decides? Time to mitigation matters far more than peak capacity.
- What exactly happens to a legitimate visitor during an attack? Ask to see the challenge page, on a phone, on a slow connection.
- Is protection always on, or does traffic reroute when an attack is detected? Rerouting adds minutes at the worst possible moment.
- What do the logs show, and for how long? You cannot write a postmortem from a dashboard that only keeps twenty-four hours.
- Are there overage charges during an attack? Some pricing models bill you for the flood you were paying to be protected from.
- What happens to TLS? Who holds the certificate, and can you pin your own?
The test that tells you most
Ask how to turn protection off. A provider with a clean, documented, reversible path in is nearly always a provider with a clean path out — and that is the same engineering culture that handles your incident well.
Read the SLA Carefully
Uptime commitments usually cover the provider network, not your site. If your origin falls over while the edge stays up, the SLA is met and you are still down. Check what is measured, where it is measured from, what the remedy is, and whether claiming it requires you to have opened a ticket during the incident.
Test Before You Need It
Put a staging hostname behind the provider and try the things that break in production: a large file download, a long-lived websocket, an API client that does not run JavaScript, a payment callback from a third party. Automated integrations are the usual casualty of a challenge page, and you want to discover that on a Tuesday afternoon rather than during an incident.
The Quiet Requirement
Whatever you choose, the protection is only as good as the secrecy of your origin. A provider cannot filter traffic that never passes through them. Before signing anything, confirm you can lock the origin to the provider addresses — and that you know every DNS record, subdomain, and mail header that might still be pointing at it.