How it works
Every request to an application or static site, on its Sevalla domain or on a custom domain, enters Cloudflare’s network first. Sevalla’s own Cloudflare zones serve these domains, so Cloudflare’s managed DDoS rulesets apply to all of them:
Cloudflare keeps both rulesets always enabled, and its protection is unmetered and unlimited. The protection doesn’t depend on your caching settings: with CDN and edge caching turned off, requests still pass through Cloudflare and stay protected.
What is covered
What is not covered
TCP proxies and database external connections don’t go through Cloudflare: their hostnames point straight at Sevalla’s TCP proxy endpoint, so Cloudflare’s DDoS protection doesn’t apply to them. To limit the risk:- Create a TCP proxy or enable an external connection only when a client outside Sevalla needs it, and remove it when it no longer does.
- Set IP restrictions on the database, so only the addresses that need it can connect. See Restrict access by IP address.
- Connect your own applications to databases over internal connections instead.
Add your own restrictions
To keep traffic away from an application that only some clients should reach, set IP restrictions on its Networking tab: allow only the addresses and CIDR blocks you list, or block them. Sevalla checks each request at Cloudflare’s edge and answers blocked ones with403 Forbidden, so they never reach your application.
Cite it in a security review
To confirm DDoS coverage in a security questionnaire or review, cite:- This page.
- Cloudflare’s DDoS protection overview, which describes unmetered, unlimited protection at layers 3, 4 and 7 for all Cloudflare customers.
- Sevalla’s compliance reports and penetration test report in the Trust Center.