DDoS protection for small apps in Europe in 2026

For a small app, the DDoS filtering your host already runs is usually enough, as long as that host is European and filters floods by default. OVHcloud and Hetzner include network-level protection on every server at no extra cost, and Eurobase filters attack traffic in front of the apps it hosts. If you want rules you control for layer 7 floods, bots and login abuse, Bunny.net offers a free Shield tier, while Gcore and Myra Security suit larger or regulated sites.

DDoS protection options at a glance

Platform	Company	What it covers	Starts at	You configure rules
Eurobase	Warsaw, Poland	Attack filtering and rate limits in front of hosted apps	Free plan, then €10 a month + VAT	Not documented
Bunny.net	BunnyWay d.o.o., Ljubljana, Slovenia	WAF, rate limits, bot mitigation, volumetric and HTTP floods	Basic Shield tier free	Yes
OVHcloud	Roubaix, France	Network floods on every product, with an edge firewall	Included with any OVHcloud product	Edge firewall rules and Anti-DDoS profiles
Hetzner	Gunzenhausen, Germany	Network floods such as SYN, UDP and reflection attacks	Included with every product	Not documented
Gcore	Contern, Luxembourg	Layers 3, 4 and 7 through scrubbing centres	L3/4 free on pay-as-you-go	Custom rules in its WAF, from €25 a month
Myra Security	Munich, Germany	DDoS protection, WAF and bot management	Not stated, demo on request	Set up with Myra's security team

Prices are from each provider's own page, checked on 10 November 2026. Bunny Shield and Gcore's DDoS plans are priced in US dollars, and Gcore says its prices don't include VAT.

What to check before you rely on it

• Which layer it stops. Network floods, such as SYN or UDP floods, are handled by most hosts. Floods of valid-looking HTTP requests reach your app's code and need request-level filtering.
• Whether it's always on. Protection that starts only after you open a ticket leaves you offline while you wait. OVHcloud, Hetzner and Bunny.net all describe automatic detection.
• Who pays for attack traffic. On per-request or per-GB billing, a flood can become an invoice. Ask whether blocked requests are billed and what happens when your monthly allowance runs out. See flat vs usage-based pricing.
• Where traffic is inspected. A filtering network decrypts and reads your requests. Check which company runs it and where its scrubbing centres are, as you would for any processor. EU region vs EU company explains why the company matters.
• What you can tune. Rate limits per path, country blocks and challenge pages help when an attack targets one login form. Defaults can't know your app.

1. Eurobase

Eurobase hosts web apps, Functions and static sites on European infrastructure run by Scaleway, a French provider. According to the Eurobase terms, attack traffic is filtered and rate limits are enforced by automated tools, which gives a small app a baseline without a second service to sign up for. Because plans are flat, an attack can't turn into a surprise usage bill. There are no usage charges today: work over a limit is refused, apps on V8 isolates and Functions stop until the monthly reset, and containers and static sites keep serving.

• Best for: small and mid-sized apps whose owners want hosting and baseline filtering in one place, at a fixed price.
• Price: a Free plan, then €10 or €20 a month + VAT per workspace.
• What it lacks: documented WAF rules or rate limits that you set yourself. ISO 27001 and SOC 2 aren't held yet; both are in progress. If you need custom rules, put a filtering service such as Bunny Shield in front of your Eurobase domain.

2. Bunny.net Shield

Bunny.net, a CDN run by BunnyWay d.o.o. in Slovenia, sells its security features as Bunny Shield. It combines a WAF covering the OWASP Top 10, rate limiting by IP, user or path, bot mitigation, access lists that can block VPNs and Tor nodes, and protection against both volumetric and HTTP floods. Bunny.net reports 119 scrubbing centres and more than 250 Tbps of network capacity.

• Best for: small teams that want to write their own firewall and rate-limit rules without a sales call.
• Price: the Basic tier is free, Advanced is $9.5 a month and Business is $99 a month. Paid tiers include a monthly request allowance, with a per-million charge above it. You start with a 14-day trial and no card.
• What it lacks: prices in euros. The free tier shows a bunny.net-branded block page.

3. OVHcloud Anti-DDoS

OVHcloud, based in Roubaix, protects every product on its network with its Anti-DDoS Infrastructure. Detection is always on: suspicious traffic is diverted to its VAC scrubbing system, which includes an Edge Network Firewall, and the control panel logs each event with traffic charts. OVHcloud says there's no cap on the number of attacks it mitigates and no traffic threshold at which protection stops. Anti-DDoS profiles let you tune sensitivity per public IP.

• Best for: apps running on OVHcloud servers, VPS or public cloud, from a personal blog upwards.
• Price: included at no extra cost with every OVHcloud product.
• What it lacks: request-level rules in the included layer. OVHcloud presents it as infrastructure protection and lists application-level security as a separate level.

4. Hetzner

Hetzner Online, from Gunzenhausen, filters DDoS attacks for all customers with Arbor and Juniper hardware. Its system identifies the attack type, scrubs known patterns such as DNS reflection, NTP reflection and UDP floods on port 80, and uses challenge-response checks against SYN floods and DNS floods. Hetzner says the protection hasn't raised prices and normal traffic is usually unaffected.

• Best for: developers running their own servers who want a sensible network-level floor.
• Price: free with every product. The entry cloud server, a CPX02, costs €5.49 a month excl. VAT in Helsinki and €6.49 in Falkenstein or Nuremberg, though the cheapest plans couldn't be ordered on 10 November 2026.
• What it lacks: request-level filtering. Floods of HTTP requests to your app are yours to handle, for example with a reverse proxy or an edge service.

5. Gcore

Gcore, headquartered in Luxembourg, filters attacks at layers 3, 4 and 7 through its own scrubbing centres, with more than 200 Tbps of capacity. It describes machine-learning analysis of request patterns to catch slow application-layer attacks.

• Best for: apps that outgrow host-level protection or run non-web services, such as game servers, that need network filtering.
• Price: L3/4 protection starts free on pay-as-you-go. Committed plans are $275 a month for 100 Mbps of clean traffic, $495 for 200 Mbps and $1,045 for 500 Mbps, excl. VAT, all with unmetered mitigation.
• What it lacks: a low-cost committed plan sized for a hobby app.

6. Myra Security

Myra Security is a Munich company that protects websites, portals and APIs with automated DDoS mitigation, alongside a web application firewall and bot management. It says it was the first provider to meet all 37 BSI criteria for DDoS mitigation service providers, and its security team works with you to set up the filtering rules.

• Best for: companies whose auditors expect a provider measured against the German BSI criteria.
• Price: not published on the page. You book a demo or use its price calculator.
• What it lacks: a self-service plan for small projects.

How to choose

1. Start with what your host includes. OVHcloud and Hetzner filter network floods on every server, and Eurobase filters attack traffic for every project.
2. Look at your logs after an incident or a traffic spike. If bad requests are reaching your app, you need request-level rules.
3. Put Bunny Shield in front of your domain and add rate-limit rules for login, signup and API paths.
4. Move to Gcore or Myra when a contract, an auditor or repeated large attacks call for committed capacity and a support line.
5. Keep your origin address private, so attackers can't skip the filtering layer and hit your server directly.

Frequently asked questions

Do I need DDoS protection for a small app?

You need the baseline, and most European hosts include it. A small site is more likely to meet bots, scrapers and brute-force attempts than a record-sized flood, so per-path rate limits often matter more than raw capacity.

Is there a European alternative to Cloudflare's free plan?

Bunny Shield's Basic tier is free and includes 71 managed WAF rules, simple bot mitigation and DDoS protection, on a network run by a Slovenian company. Cloudflare's DDoS protection is available on its Free plan too, but Cloudflare, Inc. is based in San Francisco and its terms fall under California law. For the CDN side, see European CDN providers.

Can a DDoS attack run up my hosting bill?

On usage-based pricing it can, if attack requests or bandwidth are billed. On a flat plan they aren't. On Eurobase there are no usage charges today: work over a limit is refused rather than billed, so the risk is that apps on V8 isolates and Functions pause until the monthly reset, not an invoice. Containers and static sites keep serving.

Is DDoS filtering a GDPR concern?

The filtering service reads IP addresses and requests, so it processes personal data. Sign a DPA, add it to your list of processors and prefer a company and scrubbing locations in the EU. The GDPR hosting checklist covers the rest.

Does a CDN protect my app from DDoS?

Only for traffic that goes through it, and only for what it can cache or filter. Requests that miss the cache still reach your origin, which is why CDNs pair caching with WAF and rate-limit rules.

Sources

• Bunny Shield
• OVHcloud Anti-DDoS
• Hetzner DDoS protection and Hetzner Cloud
• Gcore DDoS protection and Gcore WAF
• Myra Security DDoS protection
• Cloudflare DDoS protection
• Eurobase terms, Eurobase pricing, Eurobase plans and Eurobase subprocessors