DDoS protectionDDoS protection that is always on.
Attack traffic arrives at the nsin edge, not at your server. It is filtered there, your origin address stays hidden behind the proxy, and rate limits and challenges deal with whatever looks like a browser but is not.
Filtered before it reaches you
Every proxied hostname sits behind the nsin edge. Floods and abuse are dropped there, so your server sees clean traffic and keeps answering real visitors.
- On by default for proxied traffic
- Nothing to switch on during an attack
- Cached pages keep being served from the edge
Your origin stays invisible
A proxied DNS record answers with nsin's address. An attacker who cannot learn your server's IP cannot go around the edge and hit it directly.
- Origin IP hidden behind proxied records
- Published nsin IP ranges for your firewall allowlist
- Block by country, path or host
Rate limits and challenges for the rest
Layer-7 floods look like ordinary requests. Cap how many requests one visitor can make to a path, and answer a breach with a block or with a challenge a real person passes once.
- Per-visitor and per-path rate limits
- CAPTCHA challenge instead of a hard block
- Fingerprint rules for clients that fake a browser
Frequently asked questions
What is a DDoS attack?
A flood of traffic from many machines at once, meant to exhaust your server or your link so real visitors cannot get in.
Do I need to turn DDoS protection on?
No. It applies to every hostname that is proxied through nsin. Rate limits, challenges and block rules are extra layers you add in the Rules section.
How do I stop attackers hitting my server directly?
Keep your records proxied so your origin IP is not public, and allow only nsin's published IP ranges in your server's firewall.
Will real visitors be challenged?
Only where you add a challenge rule, and a visitor who passes is not asked again. Scope it to the paths under attack, such as a login or search endpoint.