Rules for your site
Paths, headers, countries and rate limits. Applied without a restart.
- /api/*Limit 20 req/s per address
- User-Agent: MyLauncher/*No check
- /wp-admin*Refuse
DDoS protection for websites and game projects
Point your domain at anycast.ac with one DNS record. The attack stays with us. Real visitors open your site as usual.
What is DDoS protection?
A DDoS attack floods a site with requests until it stops answering. Protection sits in front of your server, checks every request and drops the flood. Only real visitors reach your server.
Passed, a real visitor
Goes straight to your server.
Checked, looks like a bot
The browser solves a short task. People pass, scripts get stuck.
Refused, flood, scanner, fake browser
Never reaches your server. The reason is in your log.
How to connect a site
Three steps. No code, no agents on your server.
Add the site
Enter your domain and your server address.
1 minute
Change one DNS record
Copy the CNAME from the dashboard to your registrar.
a few minutes
Done
Traffic now goes through the filter. No certificate? We issue one for free.
right away
The one record you add at your registrar
NameTypeValueCopy
example.comCNAME cname.anycast.ac
www.example.comCNAME cname.anycast.ac
The same record is shown in your dashboard once you add the site.
What it protects against
Attacks on the web layer: everything that speaks HTTP and HTTPS.
HTTP floods
Thousands of requests per second to one page or API.
Bots and scrapers
Scripts that pretend to be a browser.
Vulnerability scanners
Probing paths like /wp-admin and /.env.
Password guessing
Rate limits on login and API routes.
Fake launchers
Header rules let your launcher in and stop copies.
Who it is for
Anyone whose project lives on the web.
Websites and shops
Stay open while you are attacked.
Game projects
Sites, launchers, forums and donation shops.
APIs and apps
Limits per route, not for the whole site.
Studios and agencies
Several sites in one account.
What you get
Everything is in your dashboard. No black box.
example
A report for every attack
Start, peak, duration and the main refusal reasons.
- 14:02Attack started
- 14:09Peak 41,200 req/s
- 14:31Attack ended
Main reasonsToo fast from one addressVulnerability scanner
A log of every request
Address, country, path and the reason for each refusal.
- Too fast from one address
- Vulnerability scanner
- Fake browser signature
- Too many logins from one address
Free TLS
We issue and renew a Let's Encrypt certificate. Or upload your own.
Let's EncryptRenews by itself
Edge cache
Images and static files are served from the edge and spare your server.
- /img/banner.webpfrom edge
- /js/app.jsfrom edge
- /api/cartto server
Pricing
You pay for the plan, not for the size of the attack.
Pro
For a few projects that get attacked together.
$25/ month
- 3 sites
- 3 servers
- Live event stream
- Custom rate limits
- Stats for each site
- Priority support
Heavy
No limit on sites, for bigger projects.
$70/ month
- Unlimited sites
- Event replay
- Your certificate or auto TLS
Enterprise
Dedicated capacity and a contract.
from$199/ month
- Everything in Heavy
- Dedicated edge capacity
- Contract and invoices
- Direct line to engineers
- We connect it with you
Questions
What is anycast.ac?
A service that protects websites from DDoS attacks and bots. Your traffic goes through our edge, we filter it, and only real visitors reach your server.
Do I need to change anything on my server?
No. You change one DNS record. Your code, hosting and stack stay as they are.
How long does it take to connect?
Adding a site takes about a minute. Then it depends on how fast your registrar updates DNS, usually a few minutes.
What exactly do you protect?
Everything that runs over HTTP and HTTPS: sites, APIs, launchers, panels. We do not proxy game protocols over UDP.
Will my site get slower?
Requests go through Frankfurt, Germany.
What about the TLS certificate?
We issue a free Let's Encrypt certificate and renew it for you. Or you upload your own.
Will my server see the real visitor IP?
Yes, in the X-Forwarded-For header.
What if it is a real rush of players, not an attack?
Limits are tuned to your site. Planning a launch or a wipe? Tell us in advance and we raise the thresholds.
How do I leave?
Change the DNS record back. Nothing is installed on your server, so there is nothing to remove.
How much does it cost?
From $25 per month. You pay for the plan, not for the size of the attack.
Under attack right now?
Add your domain. Filtering starts as soon as DNS updates.