DDoS protection is applied at the network level, in front of your server address. Volumetric attacks are absorbed upstream so they never reach your game process.
What it does not cover
Filtering at the network layer cannot tell the difference between abuse and legitimate traffic once the request looks valid. So it does not protect against:
- Exploit or packet spam from connected players.
- A vulnerability in a plugin or mod you have installed.
- A login flood shaped like real client connections.
- Resource exhaustion caused by something running on your own server.
What helps with those
- Keep your server software, plugins and mods updated.
- Use a whitelist or an allowlist during an active incident.
- Apply rate limits and connection throttles where your platform supports them.
- Remove plugins you do not use — every one is attack surface.
If you are under sustained attack, open a ticket with timestamps and what you are seeing. Specific detail is far more actionable than "we are being DDoSed".