Volumetric and application attacks differ
A large traffic flood can exhaust a link before the server sees it. A smaller stream of expensive requests can exhaust application workers or database connections. Different attacks require different controls.
Know the provider’s response
Ask about detection, filtering scope, maximum protection, escalation and conditions for traffic restriction. Always-on protection should still have a documented limit. No host can credibly promise immunity from every denial-of-service event.
Protect the application
Use bounded request sizes, timeouts, caching, rate limits and connection budgets appropriate to the service. Keep administration separate from public endpoints. Protect expensive work behind authentication or a queue where sensible.
Prepare an incident path
Keep an external status channel, a contact procedure and the information needed to identify an attack. Test recovery from resource exhaustion. Confirm the mitigation scope, escalation path and limits applicable to your order.