Krebs didn't pay akamai. It will be similar on cloudflare. If you're on a free plan, they will have a limit on what they will defend for you. Layer 3/4 and 7 at

Krebs didn't pay akamai. It will be similar on cloudflare. If you're on a free plan, they will have a limit on what they will defend for you. Layer 3/4 and 7 attacks are only covered in business plan, but if you use this plan (which likely makes sense for many due to other features), I'm pretty sure they won't throw you out. Mitigating DDos is one of the main selling points nowadays. That's why OVH wrote so much about the huge attack they defeated (and they didn't name the impacted clients), Cloudflare offered Krebs to host him (he refused) and other providers add scrubbing centers. I actually think it's rather cheap to defend against DDos if you're a small company. Large companies will have it harder as they have typically more complex requirements and cannot just shift everything behind cloudflare or similar services.