DDoS protection for your website: less bandwidth, lower costs
I put Cloudflare in front of your website. Attacks get stuck there instead of using up bandwidth at your host. Your website itself stays exactly as it is.
Every request goes through Cloudflare first
Attacks get stuck at Cloudflare. Only visitors and search engines reach your host.
One day from the case below
This is how many requests Cloudflare stopped for one client in 24 hours. The numbers come from Cloudflare and from my post of January 31, 2026.
What is a DDoS attack?
In a DDoS attack, a huge number of computers send requests to your website at the same time until it slows down or goes offline. Often you only notice on the invoice: with hosts that sell bandwidth in plans, such as Webflow, every request counts, whether it comes from a person or a bot. Without protection in front, you pay for the attack too.
At first glance a spike like this looks like lots of new visitors. The difference only shows when none of them gets in touch.
Lots of traffic is not the same as lots of visitors
9.1 terabytes in one month, without a campaign
A perfectly ordinary company website on Webflow. In December 2025 its bandwidth use rose to about 9.1 terabytes. About 100 gigabytes is normal. It was an attack.
The attack looked like success
No launch, no campaign, just automated traffic. Every request counted against the bandwidth allowance.
About 90 times the usual amount
What I did
01
Cloudflare in front, no rebuild
Only the DNS management moved. Webflow still hosts the site, and the CMS and Editor stayed exactly as they were.
02
Protection rules set up
Set up HTTP DDoS protection and caching rules for exactly this website.
03
Attacks stopped
Clearly malicious traffic is blocked or challenged before it reaches Webflow.
What Cloudflare stopped in 24 hours
What the client gets out of it
Editing works like before
The team keeps working in Webflow. Nothing about the project changed.
Attacks end up at Cloudflare
Malicious traffic is stopped before it reaches Webflow and the bandwidth allowance.
Attackers stay out, Google and ChatGPT get in
If you block bots too broadly, you often also block the crawlers that read your website for Google and AI answers. I set up the protection so your visibility doesn't suffer.
Six layers in front of your website
Every request passes all six before it reaches your host.
The rules decide who gets through
More on how AI systems read your website on the AI visibility page.
AI visibilityDDoS rules
Cloudflare detects attacks on the network and application layer by itself. I tune the sensitivity for your website so attacks get stuck and real visitors get through.
Firewall rules
Custom rules block what has no business on your website, such as requests to login pages you don't even have.
Rate limiting
If one address sends too many requests in a short time, for example to your contact form, it gets throttled.
Bot protection
Known malicious bots have to pass a challenge.
Caching
Images, scripts and, where possible, entire pages come from the Cloudflare cache. What sits there puts no load on your host.
Email alerts
Cloudflare tells you as soon as it has stopped an attack of more than 100 requests per second. So you don't find out from the invoice.
Is your website on Webflow?
Then your project stays as it is. Webflow keeps hosting, and your team keeps editing in the Editor. I put your own Cloudflare account in front and set the rules there. That's exactly how the case above went.
Cloudflare sits in front of Webflow, it doesn't replace it
Clients who already trusted me with their Cloudflare
“Christian was incredibly quick to help with our Cloudflare issue. He solved the problem within minutes of us reaching out … and even did so over the weekend!”Tomáš Mrázek
Client, August 31, 2025
Review on Contra“Great collaboration. Problem solved within hours.”
Jobst Ehrentraut
Client, January 14, 2026, translated from German
Empfehlung auf LinkedIn“Problem solving right to the point. Happy to work together again.”
Julian Tietze
Client, January 14, 2026, translated from German
Empfehlung auf LinkedIn5.0 from 11 reviews on Contra.
Read all reviewsHow Cloudflare gets in front of your website
01
Check
In the free 30-minute check we look at where your website is hosted, who manages your domain and whether your bandwidth use matches your visitors.
02
DNS move
You invite me to your Cloudflare account, or we create one together.
03
Rules
I set up DDoS protection, firewall, rate limiting and bot protection for your website.
04
Handover
You know where in Cloudflare to see what was blocked.
You can see for yourself what was blocked
In Cloudflare you can see at any time which rule stopped how many requests.
Is this a fit for your website?
Your domain stays with your registrar. Only the DNS management moves to Cloudflare.
Works, just like the case above.
Then I'll tell you in the check what the alternative is.
DDoS protection FAQ
Who can help me with a DDoS attack on my website?
I can. I'm Christian Schmitt, a freelancer in Bremen, Germany. I put Cloudflare in front of company websites in Germany, Austria and Switzerland and set up DDoS protection, firewall rules and bot protection there. We work over video and in your Cloudflare account, so your location doesn't matter.
Does Cloudflare's DDoS protection cost anything?
Basic protection against DDoS attacks is included in every Cloudflare plan, the free one too, and it isn't billed by the size of the attack. The free plan gives you 5 custom firewall rules and 1 rate limiting rule. Whether you need more, I'll tell you in the check.
Do I have to switch hosts for this?
No. Your website stays with your host and your domain with your registrar. Only the DNS management moves to Cloudflare.
Will this make my website slower?
Usually not. Whatever sits in the Cloudflare cache is served from a data center close to your visitors.
Does the protection also lock out Google or ChatGPT?
Only if the rules are too broad. Since September 15, 2026, Cloudflare blocks AI crawlers that collect training data or act as agents on newly added domains with ads. I check this setting and let through what your visibility on Google and in AI answers needs.
Does this also help against spam through my contact form?
Yes. A rate limiting rule on your form throttles any address that submits too often in a short time.
How much bandwidth did your website use last month?
If you don't know the number, we'll look it up together in the free 30-minute check. Afterwards you'll know whether your bandwidth use matches your visitors.
5.0 from 11 reviews on Contra. Read all reviews