Most VPS/hosting will only charge for outgoing bandwidth. Returning an HTTP 429 is (likely) pretty small, compared to returning a full response; but if that's t

Most VPS/hosting will only charge for outgoing bandwidth. Returning an HTTP 429 is (likely) pretty small, compared to returning a full response; but if that's too much, you can probably do something to drop the connection, but that's not likely to be super straightforward. You'd still be charged for SYN+ACK and what nots, although some providers charge for payload bytes only. If you're getting a lot of abuse, it'd make sense to drop packets with an IP firewall rather than HTTP config. Once you're pretty well protected against 'layer 7' application based DDoS, expect to get targetted with volumetric DDoS instead. That's just sending you garbage packets until you run out of inbound bandwidth; usually by spoofing UDP requests to the world from your IP. The requirement to handle that on your own is to have more inbound bandwidth than they're targetting you with; that and enough CPU to process their stuff, but drop all udp and drop all ip fragments is easy for firewalls. If your IP is targetted for 10Gbps of abuse, and you have a 1G connection, chances are your host will null route your IP to protect its infrastructure, same deal if you attract 100Gbps of abuse on a 10G connection. Top volumetric attacks are around 2 Tbps now, but chances are you won't attract those.