Is DDoS protection included?
In 2026, OCI’s DDoS protection is split into two layers: one that is automatic and free for everyone, and one that is customizable for high-risk applications.
Every single IP address in OCI—including your "rented" servers and even Bring Your Own IP (BYOIP) ranges—is automatically protected against high-volume, volumetric attacks.
Automatic Detection: OCI’s edge network continuously monitors all incoming traffic for patterns typical of a DDoS attack (like UDP floods or SYN floods).
Zero-Touch Mitigation: If a massive attack is detected, Oracle’s scrubbing centers automatically kick in to "clean" the traffic before it ever reaches your server.
Cost: Free. There is no hourly charge or subscription fee for this baseline infrastructure protection.
Volumetric attacks try to "clog the pipe," but Layer 7 attacks try to "crash the app" (e.g., sending millions of complex search requests to exhaust your database).
The Tool: This is handled by the OCI Web Application Firewall (WAF).
Capabilities: It uses AI-driven behavioral analysis to distinguish between a "flash crowd" of real customers and a botnet. It can automatically trigger CAPTCHAs, rate-limiting, or JS challenges to block the bad actors.
Cost: While the WAF has a small base fee, it is included free of charge for certain services like Oracle Fusion Applications.
Many attackers target the "phonebook" of the internet (DNS) to take a site offline.
Anycast Architecture: OCI’s DNS service uses a global Anycast network. This means your DNS queries are handled by dozens of different data centers simultaneously.
Resilience: Even if one data center is hit by a massive DDoS attack, the others stay online, ensuring your domain remains resolvable.
| Feature | OCI DDoS Protection | AWS Shield Standard | Azure DDoS Network |
| L3/L4 Protection | Included (Free) | Included (Free) | Included (Free) |
| L7 (WAF) Integration | Native | Native | Native |
| Scrubbing Capacity | Multi-Terabit | Multi-Terabit | Multi-Terabit |
| Cost for Advanced | Usage-based | Fixed monthly ($3k+) | Fixed monthly (~$3k) |
Modern DDoS attacks aren't just "dumb" traffic; they use sophisticated bots that mimic human behavior. OCI’s 2026 protection suite includes Advanced Bot Management, which:
Detects "low and slow" attacks that try to slip under the radar.
Protects API endpoints (not just websites) from being overwhelmed.
Uses Threat Intelligence shared across all of Oracle's global customers to block known malicious botnets the second they appear anywhere in the world.
To get the best protection, always place your public-facing servers behind an OCI Flexible Load Balancer. Because the load balancer sits at the "Edge" of Oracle's network, it benefits from the full weight of Oracle's DDoS scrubbing capacity, effectively acting as a shield for the servers sitting deeper in your private network.