> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sevalla.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> These are the docs for Sevalla, a platform for deploying applications, databases, static sites, object storage and load balancers. The dashboard is at https://app.sevalla.com.
> Bold text in steps is an exact dashboard label.
> To act on a Sevalla account, prefer the Sevalla MCP server (https://mcp.sevalla.com/mcp, see https://docs.sevalla.com/ai-agents/overview.md), then the Sevalla CLI (https://docs.sevalla.com/developer-tools/cli.md), then the REST API (https://api-docs.sevalla.com, OpenAPI spec at https://api.sevalla.com/v3/openapi.json).
> Every page index is at https://docs.sevalla.com/llms.txt.

# DDoS protection

> Web traffic to every Sevalla application and static site passes through Cloudflare's always-on DDoS protection at layers 3, 4 and 7. See what it covers, what it doesn't, and what to cite.

Sevalla routes all HTTP and HTTPS traffic to your applications and static sites through Cloudflare's network, where Cloudflare's DDoS protection detects and mitigates attacks before they reach your services. The protection is always on, has no setting, costs nothing extra and needs nothing from you.

## How it works

Every request to an application or static site, on its Sevalla domain or on a custom domain, enters Cloudflare's network first. Sevalla's own Cloudflare zones serve these domains, so Cloudflare's managed DDoS rulesets apply to all of them:

| Layer | Cloudflare ruleset | What it mitigates |
| - | - | - |
| Network (layers 3 and 4) | Network-layer DDoS Attack Protection | Attacks on the network and transport layers |
| Application (layer 7) | HTTP DDoS Attack Protection | Attacks over HTTP and HTTPS |

Cloudflare keeps both rulesets always enabled, and its protection is unmetered and unlimited. The protection doesn't depend on your caching settings: with [CDN and edge caching](/applications/caching) turned off, requests still pass through Cloudflare and stay protected.

## What is covered

| Traffic | Through Cloudflare | DDoS protection |
| - | - | - |
| Applications, on the Sevalla domain and custom domains | Yes | Layers 3, 4 and 7 |
| Static sites, on the Sevalla domain and custom domains | Yes | Layers 3, 4 and 7 |
| Internal connections between your services | No, they stay on Sevalla's private network | Not reachable from the internet |

## What is not covered

TCP proxies and database external connections don't go through Cloudflare: their hostnames point straight at Sevalla's TCP proxy endpoint, so Cloudflare's DDoS protection doesn't apply to them. To limit the risk:

* Create a TCP proxy or enable an external connection only when a client outside Sevalla needs it, and remove it when it no longer does.
* Set IP restrictions on the database, so only the addresses that need it can connect. See [Restrict access by IP address](/databases/connect#restrict-access-by-ip-address).
* Connect your own applications to databases over [internal connections](/applications/networking#internal-connections) instead.

## Add your own restrictions

To keep traffic away from an application that only some clients should reach, set [IP restrictions](/applications/networking#ip-restrictions) on its **Networking** tab: allow only the addresses and CIDR blocks you list, or block them. Sevalla checks each request at Cloudflare's edge and answers blocked ones with `403 Forbidden`, so they never reach your application.

## Cite it in a security review

To confirm DDoS coverage in a security questionnaire or review, cite:

* This page.
* Cloudflare's [DDoS protection overview](https://developers.cloudflare.com/ddos-protection/about/), which describes unmetered, unlimited protection at layers 3, 4 and 7 for all Cloudflare customers.
* Sevalla's compliance reports and penetration test report in the [Trust Center](/security/overview#get-the-soc-2-report-and-other-documents).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.