DDoS protected VPS
DDoS protection on every server. And the limits, in writing.
Floods don’t knock first. Every LiteKeep server has always-on network filtering that drops layer 3 and 4 floods before they reach your port, at no extra cost. We’ll also tell you what it doesn’t cover.
Launch offer: we double your first deposit. Deposit $100, spend $200. Your server is usually ready within 15 minutes; delete it any time.
Arriving
Flood Real visitors
Your server receives
Real traffic only
Plans and prices
Every Lite is DDoS protected.
All prices in USD, without VAT. Customers in the EU pay their country’s VAT on top. No setup fees, no contracts.
The filtering comes with the server: no add-on, no separate plan. Billed per started hour, capped monthly.
| Plan | vCPU | RAM | Storage | Traffic | Hourly | Monthly | Keep a year | Action |
|---|---|---|---|---|---|---|---|---|
| Lite 2 | 2 | 2 GB | 40 GB NVMe | 1 TB | $0.006 | $4 | $40save $8 | Get it Lite 2 |
| Lite 6 | 6 | 6 GB | 100 GB NVMe | 2 TB | $0.012 | $8 | $80save $16 | Get it Lite 6 |
| Lite 8 | 8 | 8 GB | 160 GB NVMe | 3 TB | $0.018 | $12 | $120save $24 | Get it Lite 8 |
| Lite 16 | 16 | 16 GB | 320 GB NVMe | 4 TB | $0.03 | $20 | $220save $20 | Get it Lite 16 |
| Lite 32 | 16 | 32 GB | 640 GB NVMe | 6 TB | $0.06 | $40 | $440save $40 | Get it Lite 32 |
| Lite 64 | 24 | 64 GB | 1,280 GB NVMe | 8 TB | $0.12 | $80 | $880save $80 | Get it Lite 64 |
| Lite 96 | 32 | 96 GB | 1,920 GB NVMe | 10 TB | $0.18 | $120 | $1,320save $120 | Get it Lite 96 |
| Lite 128 | 40 | 128 GB | 2,560 GB NVMe | 12 TB | $0.24 | $160 | $1,760save $160 | Get it Lite 128 |
| Lite 192 | 48 | 192 GB | 3,840 GB NVMe | 14 TB | $0.36 | $240 | $2,640save $240 | Get it Lite 192 |
| Lite 256 | 64 | 256 GB | 5,120 GB NVMe | 16 TB | $0.48 | $320 | $3,520save $320 | Get it Lite 256 |
What’s covered
Covered, and not covered.
| Attack | Example | Covered |
|---|---|---|
| Volumetric floods (layer 3/4) | Amplified DNS, NTP or memcached floods | Yes, filtered upstream |
| Protocol attacks (layer 3/4) | Floods of fake connection requests | Yes, filtered upstream |
| Application attacks (layer 7) | Floods of real-looking HTTP requests | No: add a CDN, web firewall and rate limits |
Layer 7 attacks look like real visitors, so they’re handled in front of your app, not in the network. Our DDoS guide shows what to add.
How it works
Filtered before it reaches you.
- Always watchingTraffic to your address is watched continuously, so you don’t have to report an attack for filtering to start.
- Scrubbed upstreamDuring an attack, traffic is routed through filtering equipment. Flood packets are dropped; real ones pass.
- Server stays onlineClean traffic reaches your server, so visitors and players can keep connecting.
Why upstream? A memcached reflection attack can amplify traffic up to 51,000 times. No server’s own connection can absorb that.
Every country
The same filtering in all 15 countries.
All traffic to our servers passes through the same always-on filtering, so a server in Tokyo is protected exactly like one in Frankfurt. You don’t pick a protected location or pay a regional surcharge.
- Always onNo ticket to open and nothing to switch on. Filtering starts the moment your server is ready, usually ready within 15 minutes.
- IncludedNo add-on, no separate plan, no price difference between countries.
- Your bill is safeOnly outbound traffic counts toward your allowance, so incoming flood traffic doesn’t eat into it.
See every country, with latency from each, on the locations page.
What to deploy
Pick the server for what you protect.
A game server
UDP floods are the classic attack on game servers, and they are layer 3 and 4: filtered before they reach you. Eight vCPUs and 8 GB of RAM host a busy community server.
Lite 8$12/mo
Deploy Lite 8A VPN or proxy endpoint
An endpoint has a public address, so it can be flooded. The smallest Lite runs WireGuard for a household or a small team, and the filtering keeps it reachable.
Lite 2$4/mo
Deploy Lite 2A website or shop
Network floods are filtered for you; add a CDN or web firewall for HTTP floods. Six vCPUs and 6 GB of RAM carry a store and its database.
Lite 6$8/mo
Deploy Lite 6
Your part
Five steps for what the network can’t see.
HTTP floods look like real visitors, so they are stopped in front of your app. Five steps cover most of it:
- Put a CDN in frontLet it absorb and cache requests, and turn on its bot and DDoS settings.
- Hide the originPoint DNS at the CDN only, and accept web traffic from the CDN alone.
- Rate-limitCap requests per IP on logins, searches and APIs, in your web server or app.
- Close what you don’t useA firewall that allows only the ports you serve leaves less to attack.
- Tell usOpen a ticket with the times and what you saw; our target for a first reply is 20 minutes, any hour.
The DDoS protection guide explains each attack type, and the SSH hardening tutorial locks down the way you log in.
What people use it for
Made for the work, not the brochure.
Game servers
Minecraft and other UDP games, filtered upstream.
Websites and shops
Network floods dropped; add a CDN for layer 7.
VPNs and proxies
Your endpoint stays reachable during a flood.
APIs and bots
Always-on filtering, no ticket needed.
Mail and DNS
Infrastructure that has to stay up.
Anything public
If it has an address, it can be flooded.
The rules
What to do if you’re attacked.
Network floods are filtered automatically. You don’t need to open a ticket for filtering to start.
If your website slows under a flood of requests, that’s layer 7: turn on your CDN’s protection and tighten rate limits.
Tell us anyway, with timestamps and what you saw. CISA’s own advice is to contact your hosting provider during an attack.
Locations
Available in 15 countries.
BulgariaIn stock
GermanyIn stock
IcelandIn stock
JapanIn stock
LithuaniaIn stock
LuxembourgIn stock
MoldovaIn stock
NetherlandsIn stock
PakistanIn stock
RomaniaIn stock
SingaporeIn stock
SwedenIn stock
TurkeyIn stock
Ukraine*See note below
United StatesIn stock
* Ukraine: Service may be disrupted by the war. Keep backups in another country.
DDoS protection FAQ
Questions before you buy.
Does every plan include DDoS protection?
Yes. Every Lite, Keep, Forever Keep, Traffic Lite, Vault and Forge has the same always-on network filtering, at no extra cost.
Does it protect my website from HTTP floods?
Not on its own. Layer 7 attacks look like real visitors. Add a CDN or web firewall and rate limits; our DDoS guide explains how.
Is it good for game servers?
Floods against game servers are layer 3 and 4 attacks, which the filtering covers. Hiding your server’s address behind a proxy, where your game allows it, helps too.
Do I need to turn DDoS protection on?
No. It is always on for every server, from the moment it is ready. There is nothing to order and no setting to change.
Is the protection the same in every country?
Yes. All our servers sit behind the same filtering, so every one of our 15 countries gets the same protection at the same price.
Does attack traffic count against my traffic allowance?
Only outbound traffic counts toward your allowance, so incoming flood traffic doesn’t use it up. What your server sends out still counts as usual.
What should I do during an attack?
Network floods are filtered without you doing anything. If a website slows down under a flood of requests, turn on your CDN’s protection and tighten rate limits, then open a ticket with the times.
Can I pay with crypto?
Yes: BTC, ETH, USDT, USDC, SOL, BNB, XRP or XMR. How crypto payments work.
The rest of the keep
Same account, same balance, six more ways to build.
Floods filtered upstream.
On every server, from $4 a month.
Top up in crypto (deposit $100, spend $200 on your first one), pick a country. Your server is usually ready within 15 minutes. No card, no ID, no contract.