tencent cloud

DDoS Defender (Anti-DDoS)

DDoS Defender delivers automated attack mitigation and traffic cleansing for cloud and internet-facing workloads, with protection capacity of up to Tbps scale. Attack traffic is automatically mitigated, and mitigated attack traffic is not billed. With DDoS Defender, you can keep your business online during large-scale attacks and reduce security build-out and operations costs.

Why choose Tencent Cloud DDoS Defender?
Hyper-scale attacks have grown 7x in 3 years
25 Tbps+
Total protection bandwidth across the network
9
Countries and regions covered by mitigation centers
4.1 Tbps
Largest attack peak mitigated in 2025
Tbps-scale capacity, automated mitigation, predictable cost
Tencent Cloud DDoS Defender provides Tbps-scale mitigation capacity, in-house AI-powered cleansing, and subscription plans that keep your business online during attacks and your bill predictable.
Tbps-scale protection capacity
Mitigation centers are deployed across multiple regions worldwide, with total protection bandwidth exceeding 25 Tbps, effectively mitigating DDoS attacks at the network, transport, and application layers.
Tbps-scale protection capacity
Mitigation centers are deployed across multiple regions worldwide, with total protection bandwidth exceeding 25 Tbps, effectively mitigating DDoS attacks at the network, transport, and application layers.
Automatic detection and mitigation
In-house cleansing algorithms combined with AI-based signature detection cover volumetric attacks such as SYN Flood and UDP Flood, automatically adapting protection policies and reducing the operational overhead of security teams.
Automatic detection and mitigation
In-house cleansing algorithms combined with AI-based signature detection cover volumetric attacks such as SYN Flood and UDP Flood, automatically adapting protection policies and reducing the operational overhead of security teams.
Costs stay under control
Mitigated attack traffic incurs no charges. Clean data transfer fees are calculated only on clean business traffic after mitigation, so large-scale attacks do not affect your bill.
Costs stay under control
Mitigated attack traffic incurs no charges. Clean data transfer fees are calculated only on clean business traffic after mitigation, so large-scale attacks do not affect your bill.
Tbps-scale protection capacity
Mitigation centers are deployed across multiple regions worldwide, with total protection bandwidth exceeding 25 Tbps, effectively mitigating DDoS attacks at the network, transport, and application layers.
Automatic detection and mitigation
In-house cleansing algorithms combined with AI-based signature detection cover volumetric attacks such as SYN Flood and UDP Flood, automatically adapting protection policies and reducing the operational overhead of security teams.
Costs stay under control
Mitigated attack traffic incurs no charges. Clean data transfer fees are calculated only on clean business traffic after mitigation, so large-scale attacks do not affect your bill.
Monthly Plans
DDoS Defender offers two subscription plans, Essential Plan and Premium Plan, billed per Tencent Cloud root account. You can purchase Protection Capacity Add-ons to upgrade to Ultimate Protection. For details, see Billing Overview >
Suitable for users with a lower risk of attacks
Cost-effective
Essential Plan
1,300USD/month/account
L3/4 DDoS protection
HTTP DDoS protection when bound to an EdgeOne domain
Can be associated with CVM, CLB, EIP, WAF, LH, and EdgeOne resources
After the mitigation sessions are used up, you can upgrade to the Premium Plan to continue using the service
Mitigation sessions
2 best-effort mitigation sessions per month
Clean data transfer included
10 TB per month
Protected resources included
25 counts
Suitable for users with high service availability requirements
Premium Plan
5,000USD/month/account
L3/4 DDoS protection
HTTP DDoS protection when bound to an EdgeOne domain
Can be associated with CVM, CLB, EIP, WAF, LH, and EdgeOne resources
Custom Protection Policies available as an additional purchase to gain Security Expert Support
Mitigation sessions
Unlimited
Clean data transfer included
10 TB per month
Protected resources included
100 counts
Suitable for users with a lower risk of attacks
Cost-effective
Essential Plan
L3/4 DDoS protection
HTTP DDoS protection when bound to an EdgeOne domain
Can be associated with CVM, CLB, EIP, WAF, LH, and EdgeOne resources
After the mitigation sessions are used up, you can upgrade to the Premium Plan to continue using the service
Mitigation sessions
2 best-effort mitigation sessions per month
Clean data transfer included
10 TB per month
Protected resources included
25 counts
1,300USD/month/account
Suitable for users with high service availability requirements
Premium Plan
L3/4 DDoS protection
HTTP DDoS protection when bound to an EdgeOne domain
Can be associated with CVM, CLB, EIP, WAF, LH, and EdgeOne resources
Custom Protection Policies available as an additional purchase to gain Security Expert Support
Mitigation sessions
Unlimited
Clean data transfer included
10 TB per month
Protected resources included
100 counts
5,000USD/month/account
Documentation
Product Introduction
Learn about the overview, benefits, and features of Tencent Cloud DDoS Defender
Configuration
Learn how to configure and operate Tencent Cloud DDoS Defender
Billing
Learn about purchasing and billing for Tencent Cloud DDoS Defender
FAQs
Which resources can a DDoS Defender protection be associated with? Can it protect self-built IDC servers or servers outside Tencent Cloud?

A DDoS Defender protection can be associated with resources such as CVM, CLB, EIP, WAF, LH, and EdgeOne (domains, L4 proxy instances, and BGP transit CIDRs). Protection instances are not bound to a region and can be associated across regions. Workloads outside Tencent Cloud or in self-built IDCs can be protected through EdgeOne proxy or BGP transit origin forwarding.

Is attack traffic billed?

Mitigated attack traffic incurs no charges. Clean data transfer fees are calculated only on clean business traffic after mitigation. Up to 10 TB per month is included in the plan, and usage beyond that is billed with pay-as-you-go method.

FAQs
Which resources can a DDoS Defender protection be associated with? Can it protect self-built IDC servers or servers outside Tencent Cloud?

A DDoS Defender protection can be associated with resources such as CVM, CLB, EIP, WAF, LH, and EdgeOne (domains, L4 proxy instances, and BGP transit CIDRs). Protection instances are not bound to a region and can be associated across regions. Workloads outside Tencent Cloud or in self-built IDCs can be protected through EdgeOne proxy or BGP transit origin forwarding.

Is attack traffic billed?

Mitigated attack traffic incurs no charges. Clean data transfer fees are calculated only on clean business traffic after mitigation. Up to 10 TB per month is included in the plan, and usage beyond that is billed with pay-as-you-go method.

Get started with DDoS Defender with just a few simple configurations