Best anti-DDoS for FiveM: how to choose one
Updated Facts last verified Next review by
There is no single best anti-DDoS for FiveM. There is a best fit: the option whose documented properties match where your server runs, which attacks it actually gets, the number of players you run and the way you would rather pay. A page that names a winner without saying what it assumes about your server is an advert.
This guide gives you eight checks and a way to test each one yourself, then assigns seven common situations to the option that fits: OVHcloud’s Game DDoS Protection, Evolution Host, ShieldCore or FiveShield. How the attacks work is on the FiveM anti-DDoS page. This page is only the decision.
FiveShield wrote it and sells one of the four. That is repeated below, every claim about another vendor is read from that vendor’s own pages and dated, and in five of the seven situations the answer is an option other than FiveShield.
The short answer: three questions decide it
Answer them in this order. Each removes options before price comes into it.
Where does your server run?
If it already runs on, or can move to, a current OVHcloud Game server, protection is part of the rental, so that is the first thing to evaluate. If it is on a VPS, a different OVHcloud product line or any other host, that route is closed, and the choice is between protections that sit in front of the server.
Which attacks do you have to survive?
A volumetric flood, a flood of fake connections that imitate players and a flood of resource downloads are stopped in different places. The first is what every network-level protection is built for; the other two need a filter that knows FiveM and a cache. The attack table maps each one to the check that covers it.
How do you want to be billed?
A flat monthly plan with a player cap, a daily charge per player that follows your peak, and protection bundled into a server rental are three different shapes of price. Which costs less depends on how your population moves, not on the list price. The cost section puts them next to each other without converting currencies.
What this guide does not do
This guide ranks nothing and makes no claim that one option stops more attacks than another. No independent test of any of them turned up and we ran none, so every difference below is one you can check against the vendor’s own text.
Who wrote this, and how the guide is built
Disclosure
FiveShield wrote this guide and sells one of the options in it. Our proxy servers are hosted at OVHcloud, which is also one of the options, so it is at once our infrastructure supplier and something we compare against. No affiliate links, no sponsorship, no paid placement: nobody paid to appear here.
Whatever is said here about OVHcloud, Evolution Host or ShieldCore is taken from that vendor’s own pages, documentation or contract terms as they stood on 7 October 2026, or on the later day the Sources list shows for a page read again. Each statement is given with its source and its read date, and the Sources list shows every page used. What is said about FiveShield comes from FiveShield’s own documentation, a first-party source that nobody outside the company has tested.
How the guide is built
- Criteria first. The checks come before any vendor is named, and each has a test you can run without us.
- Each statement about a vendor says how it is sourced (its documentation, its website, its contract terms, a structural consequence of those, or “not published”) and points to a numbered source with the day it was read.
- “Not published” means the pages we read do not say. It does not mean the feature is missing.
- No competitor’s service was bought or tried for this guide, and no independent test of any of them was found. No sentence here says that one filters better than another.
- Prices are in each vendor’s own currency, dated, with the tax treatment the vendor states. No conversion and no ranking.
- There are no logos, star ratings or review scores, and no network capacity is passed off as FiveShield’s own.
- Facts checked on 7 October 2026. The next check is due by 6 November 2026, earlier if a cited page changes. If you find an error, say so on Discord (opens in a new tab) and see the change log for what was fixed.
What your server has to survive
Three attacks, three different bottlenecks, three places where they have to be stopped. This is the short version; how each one works is on the FiveM anti-DDoS page and is not repeated here.
Scroll sideways to see every column.
| Attack | What it saturates | Where it has to be stopped | Check |
|---|---|---|---|
| Volumetric UDP flood (layer 4) | Your network link | Upstream of your link, on a network with the capacity to absorb it | 1 |
| Flood of well-formed connection attempts (layer 7, the cfx.re handshake) | FXServer’s CPU | Before FXServer, by a filter that checks the handshake | 2 |
| Resource-download flood | Outbound bandwidth | Away from your machine, by serving the files from a cache | 4 |
Query flood on port 30120 (getinfo, players.json) and SYN flood on the txAdmin panel (port 40120) | The main thread; the panel’s connection table | The same places: a filter that knows the queries, and a protected panel | 2, 4 |
One more item is not an attack but decides how all of them end: whether the attacker knows your machine’s address. That is check 3.
Four checks on what it has to stop
Each check has the same three parts: why it matters, the question to put to a vendor, and a way to test it yourself. Where vendors have published something that answers a check, their statements follow it, each with how it is sourced and the day it was read; where this page quotes none, it says so.
None of the tests involves attacking anything. Do not try to prove a protection by flooding your own server: the FAQ says why.
1. Does it stop the flood before it reaches your link?
A volumetric flood only has to exceed your uplink, so it has to be stopped upstream of it, on a network with the capacity to absorb it. On the attacked machine it is already too late. What you need to know is where the traffic is dropped, whether that protection is always on or starts when an attack is detected, and what happens before it starts.
A capacity figure in Tbps describes a whole network, not a promise about your server, and a contract may say more than the marketing does. As an example of what a contract can say, here is what OVHcloud’s worldwide terms (the set with OVH Hosting Inc.; the terms that apply to you depend on the OVHcloud entity you contract with) say about its always-on layer, which sits under every OVHcloud service, including the proxy servers FiveShield runs.
Ask the vendor
Where is attack traffic dropped, is that protection always on or does it start on detection, and what do the terms say about the time before it starts?
Test it yourself
- Find the answer in the vendor’s documentation or terms rather than in a sales chat, and note the date you read it.
- Check whose network a capacity figure describes (the vendor’s own or its infrastructure supplier’s) and when it was stated.
- Look at the vendor’s status page or incident history, if it has one, and at how past incidents were described.
- In a trial, look for a view of traffic dropped versus traffic passed. A service that shows you nothing about what it dropped leaves you guessing during an incident.
What the vendors publish
- OVHcloud Anti-DDoS Infrastructure
Mitigation starts once an attack is detected; until then the service takes the attack. The terms also say OVHcloud may reinforce protection in ways that degrade the service or affect its availability.
Its contract terms say[7]
No other vendor’s words are quoted for this check: put the question above to each vendor and keep the answer in writing.
2. Does it understand FiveM, or only UDP?
Once raw volume is absorbed, the harder attack is traffic that looks like players: well-formed connection attempts that a generic filter forwards and your FXServer then has to refuse. Telling them apart means checking the cfx.re handshake. The same goes for queries: getinfo and getstatus over UDP, and the info.json and players.json endpoints on port 30120, can each be repeated until the main thread is busy, with barely a bandwidth spike.
“Game-aware” is a claim until it says what is checked. A vendor may list a FiveM profile or “layer 7 validation” without saying what that covers. That is not a defect; it is the question to ask. The handshake is also what changes with FiveM for GTA V Enhanced: Cfx.re’s development update of 1 July 2026 (opens in a new tab) says it is replaced and that existing protections will need to be adjusted. Ask every vendor in writing which FiveM server versions its filter supports. This page makes no statement about any vendor’s support, FiveShield’s included.
Ask the vendor
What exactly does the filter check on a FiveM connection and on getinfo and players.json requests, which server versions does it support, and where is that written down?
Test it yourself
- This is the one check you cannot prove yourself without generating attack traffic, which you must not do yourself. Treat the written answer as the evidence, and a vague answer as an answer.
- Ask for the list of what is checked. Anything that is not on it is something your FXServer still answers itself.
- Ask how you would see a rejected connection attempt (a log, a counter, a graph). If the answer is “you would not”, you cannot tell filtering from silence.
- Looking back at an incident: a server that vanishes from the listing though it is up, and players stuck on “Failed to get info from server (tried 3 times)”, both suggest queries were being flooded rather than the link. The problem guide explains how to tell that from a fault on the player’s side.
What the vendors publish
- OVHcloud Game DDoS Protection
Lists a FiveM profile on GAME-1 and GAME-2 servers (2024 and later). What the profile validates is not published.
- Evolution Host (FiveM DDoS Protection)
Says every packet is analysed to confirm it is valid FiveM traffic, and lists “Full layer 7 validation” and HTTP flood protection.
Its website says[8]
- ShieldCore (reverse proxy)
Lists L3/L4/L7 “HTTP/TLS” protection. Its site does not describe cfx.re handshake filtering.
- FiveShield (publisher of this page)
Each connection is checked against the FiveM protocol before it is forwarded; an attempt that fails the handshake does not reach FXServer.
FiveShield’s documentation says[19]
These are statements as each vendor publishes them, not test results. Put the question above to each vendor anyway and keep the answer in writing.
3. Does your real IP stay hidden, and stay hidden?
Filtering is defensive; hiding the origin is what ends the cycle. If an attacker has your machine’s address, a protection that filters only what passes through it can be walked around. And a protection that works on the server’s own address cannot hide that address, because it is the address.
A protection placed in front can hide it, but only while the address is not published anywhere else: in a forgotten DNS record, on a website served from the same machine, inside a script that calls a fixed address, or in the Cfx.re listing. The origin itself should also refuse everyone except the proxy.
Ask the vendor
Will my machine’s address stay out of the Cfx.re listing, and what stops traffic sent straight to my origin?
Test it yourself
- Look at what the listing publishes with CFX Finder. A raw address there is your machine’s unless it belongs to your proxy; that is the first thing to fix.
- Check your DNS for old records and subdomains that still point at the machine (
digornslookupon every name you have used). - Check that nothing else on the machine, such as a website or a panel, answers on its public address.
- From a phone on mobile data, open
http://<your origin address>:30120/info.json. An answer means the origin can be reached directly, so an attacker who learns the address can reach it too: ask how to restrict the origin to the proxy’s addresses. Run this only against your own server, and do not post the address.
What the vendors publish
- OVHcloud Game DDoS Protection
The firewall protects the IP address associated with the server, so the server keeps and publishes that address.
Its documentation says · Structural fact[1]
- Evolution Host (FiveM DDoS Protection)
Not described on its FiveM page. A generic EvoShield guide describes a tunnel option that routes all traffic through EvoShield so the server’s real IP does not leak.
- ShieldCore (reverse proxy)
Not described on its site. The order form asks for your server’s current IP and port.
Not published[17]
- FiveShield (publisher of this page)
Players connect to a proxy address and never learn your machine’s. It can still leak through an old DNS record, a website on the same machine or a hard-coded address.
FiveShield’s documentation says[19]
These are statements as each vendor publishes them, not test results. Put the question above to each vendor anyway and keep the answer in writing.
The full list of ways an address leaks is in How to hide your FiveM server IP.
4. Is everything else that can be hit covered?
Two more things get attacked, and neither shows on a bandwidth graph first. Resource downloads: every new player pulls your resources, and a flood of those requests saturates outbound bandwidth with traffic that is perfectly legitimate, so only a cache fixes it. And the txAdmin panel, which listens on its own port (40120 by default) and gets nothing from whatever protects the game port unless the vendor extends it.
Anything else on the machine (a website, a database port, a second game) is a target too, unless the protection says it covers it.
Ask the vendor
Are resource downloads served from your cache or from my machine, is txAdmin covered, and which other ports are included?
Test it yourself
- Join with an empty client cache and watch your host’s outbound traffic while the resources download. If the whole pack leaves your machine for every new player, nothing is caching it.
- From mobile data, try
http://<your origin address>:40120. If the panel’s login page appears, the panel is reachable by anyone. - List every service on the machine and ask, port by port, which are covered. If the answer is “the game port only”, the rest is yours to protect.
This page quotes no vendor’s words for this check. FiveShield’s documentation describes a cache that serves resource files and protection for the txAdmin panel, both part of the price; for the others, ask. Why a FiveM server needs a CDN cache explains the first.
Four checks on how it fits your server
These decide whether a protection that is good in general is right for your server, your players and your budget.
5. What do you have to change, and how do you undo it?
The biggest fork is not filtering quality; it is what you must change. A protection that comes with a particular server product asks you to be on it. A protection added in front of your server asks you to change how players reach it. Both can be right. Each costs time and carries risk, and the part people forget is the way back.
Ask the vendor
What do I change on the server and in my DNS, who does it, how long is the downtime, and how do I undo it?
Test it yourself
- Count the steps in the setup documentation before you buy. If it asks for a migration or a new IP, add the time and the downtime.
- Do the first install on a spare test server (a second FXServer on another port), not on the live one.
- Write down how you would undo each step, and do the undo once during the trial.
This page quotes no vendor’s words for this check: put the question above to each vendor and keep the answer in writing.
6. What does it cost at your player count?
Published prices measure different things: a flat monthly price for a plan with a player cap, a charge per player for each day set by that day’s peak, or protection bundled into a server rental. They cannot be compared until you apply each rule to your own numbers, in the vendor’s own currency and with its tax treatment.
Ask the vendor
What is the billing unit, what happens above the cap, what is the minimum term, and how do I stop?
Test it yourself
- Take your last 30 daily peaks from your own logs or monitoring and price them under each rule. Include your busiest day, not only the average.
- Read what happens above a cap before you buy, not after the first busy night.
- The worked example does the arithmetic for 32, 64, 100 and 150 players.
7. What does it add to latency and voice?
A proxy is an extra network hop by construction; a protection applied on the server’s own address is not one. What matters is the added delay and, for voice, its variation: Mumble and PMA-Voice notice jitter that game traffic tolerates. “No added latency” is a claim until it comes with a figure and a method.
Ask the vendor
How much latency does it add, measured how, from where to where, and what does it do to voice?
Test it yourself
- Pick three players in different regions, including your furthest, and test at the same hour on two evenings, with and without the service.
- Send 100 pings to the server in each case. Compare the average, and the gap between the fastest and the slowest reply: that gap is the jitter voice notices.
- Ask them to talk for five minutes each time and to say if anything sounds different.
- Do this with real players during the trial, not from your own connection.
This page quotes no vendor’s words for this check: put the question above to each vendor and keep the answer in writing.
8. What happens when the attack outgrows it, and who answers?
Vendors document their limits in different places and in different words: a contract that calls protection partial, a player cap, a monthly allowance of clean traffic, a location that cannot be changed afterwards, or a statement that no service can guarantee 100%. A vendor that lists no limit has not told you where it is.
Then there is who answers. During an attack you need a person, in a channel you can reach at an awkward hour, with a response time that is written down rather than promised. And uptime figures are not interchangeable: a target, an availability SLA on the server and a contract with remedies are three different things.
Ask the vendor
What are the limits of the plan, what happens above them, how do I reach a person during an attack, and is the uptime figure a target or a contract?
Test it yourself
- Read the terms for words like “partial”, “as is” and “best effort”, and for what happens above a cap.
- During the trial, put a real question to the support channel at an awkward hour and time the reply. Do it before you need it.
- Read the refund terms: what you pay for a day on which the service failed.
This page quotes no vendor’s words for this check: put the question above to each vendor and keep the answer in writing.
“Best for…”: which option fits which situation
Each of these seven situations is matched to the options whose documented properties fit it. FiveShield is the only option listed for one of them, one of several listed for one more, and not listed for the other five. A vendor may do more than its pages say, so “listed” means what the cells below document and nothing beyond it. The sourced reasons are below.
This is not a ranking. A different server gets a different row, and “where it stops fitting” matters as much as “why it fits”.
Scroll sideways to see every column.
| If this describes you | What fits | Reasons |
|---|---|---|
| You already rent, or were about to rent, a current OVHcloud Game server (GAME-1 or GAME-2) | OVHcloud Game DDoS Protection, included with the server | Why, and where it stops fitting |
| You want hosting and protection from one company | OVHcloud (Game server), Evolution Host or ShieldCore, depending on which hosting you prefer | Why, and where it stops fitting |
| You want one fixed monthly bill, in euros with VAT included (a large, steady server, for example) | Evolution Host or ShieldCore (flat monthly plans with a player cap) | Why, and where it stops fitting |
| You run a few small servers, a server whose population swings, or an event or seasonal server | FiveShield (per player per day, no subscription) | Why, and where it stops fitting |
| You need to protect more than the FiveM server: a website, a database port or another game on the same machine | OVHcloud’s base layer at the network level; Evolution Host’s generic remote service for other ports (ask what the FiveM plan includes) | Why, and where it stops fitting |
| Your server is on a VPS, an OVHcloud line without Game protection, or another host, and it is staying put | A protection added in front: Evolution Host, ShieldCore or FiveShield (this guide does not pick one) | Why, and where it stops fitting |
| You want a contract: an availability SLA, a phone line, a large operator | OVHcloud (Game server) | Why, and where it stops fitting |
You already have an OVHcloud Game server
Fits OVHcloud Game DDoS Protection, included with the server
Why it fits
Nothing to add: no extra vendor, no extra network hop, no extra invoice. Configure it for the IP your server uses, test it, and add something in front only if one of the checks above shows a gap. FiveShield’s guide to free protection shows how to turn on OVHcloud’s Game firewall.
Where it stops fitting
The protection sits on the server’s own address, so that address stays the one players and the listing see (check 3), and what OVHcloud’s FiveM profile validates is not published (check 2). Whether it can sit behind a reverse proxy has not been tested by anyone we could find.
What the vendors publish
- OVHcloud Game DDoS Protection
OVHcloud Bare Metal Game dedicated servers only: the documentation rules out other ranges and the product page says VPS has none. On the Eco line it may be unavailable or limited.
- OVHcloud Game DDoS Protection
Lists a FiveM profile on GAME-1 and GAME-2 servers (2024 and later). What the profile validates is not published.
- OVHcloud Game DDoS Protection
The firewall protects the IP address associated with the server, so the server keeps and publishes that address.
Its documentation says · Structural fact[1]
You want one company for hosting and protection
Fits OVHcloud (Game server), Evolution Host or ShieldCore, depending on which hosting you prefer
Why it fits
One invoice, one support desk, one party to call. OVHcloud’s protection comes with its Game server. Evolution Host sells FiveM server hosting [13] as well as its separate protection service, and ShieldCore sells VPS plans with anti-DDoS [18]. FiveShield does not sell hosting, so it is not an answer to this one.
Where it stops fitting
A bundle ties your protection to your hosting: moving host means moving protection. Compare the hosting itself first. This guide does not, and the protection is only one part of what you would be buying.
You want one fixed monthly bill in euros
Fits Evolution Host or ShieldCore (flat monthly plans with a player cap)
Why it fits
A plan’s price does not move with your daily peak, so the bill is easy to forecast, and the steadier and larger the population, the more that is worth. Both publish plans in euros: ShieldCore’s are shown VAT included, and Evolution Host states that VAT is part of its prices where applicable. The amounts and the date they were read are below.
Where it stops fitting
A plan has a cap. Check what happens above it (the Evolution Host pages we read do not say) and, on its lower plans, the monthly allowance of clean traffic. A flat plan also costs the same on a quiet day.
FiveShield’s rates ($0.030–$0.047 CAD for each additional player-day) mean a large, steady server pays a little more every month for each extra player, which is the shape where a flat plan is the easier bill to plan. FiveShield bills in Canadian dollars, and its pricing page does not say how tax is treated.
What the vendors publish
- Evolution Host (FiveM DDoS Protection)
Monthly tiers by concurrent players: €40 (32 players), €80 (64), €120 (90), €200 (140), €340 (unlimited). As of 7 October 2026; its page says prices include VAT where applicable.
Its website says[8]
- ShieldCore (reverse proxy)
Monthly tiers by maximum players, VAT included: €93.99 (100 players), €140.99 (150), €175.99 (200), up to €713.99 (1,000). As of 7 October 2026.
- Evolution Host (FiveM DDoS Protection)
A player cap per tier; 5, 7 and 10 TB a month of clean traffic on Levels 1 to 3; behaviour above a cap is not published. Per its generic guide, existing connections are invalid when a profile is first added.
Its website says · Its documentation says · Not published[8][11]
You want the bill to follow your players
Fits FiveShield (per player per day, no subscription)
Why it fits
The charge follows each day’s peak: $2.25 CAD per day covers the first 50 players, each further player adds $0.030–$0.047 CAD for that day, and there is no subscription and no charge while a server is disabled. A server that peaks high two nights a week pays the higher rate on those days only, and one switched off between events pays nothing in between. Setup takes a single block pasted into server.cfg, around five minutes, with no migration.
This is why it is the only option listed here: of the four, it is the only one that publishes per-day billing. The others publish flat plans or bundle protection into a server rental, and their minimum terms and cancellation rules are not recorded in this guide, so ask whether a plan stretches to a population that swings.
Where it stops fitting
Billing is in Canadian dollars, and the pricing page does not say how tax is treated. The proxy location is chosen when you add the server and cannot be changed afterwards. Support is on Discord rather than a phone line, and 99.9% is a target, not a service-level agreement. A large, steady server pays more each month as it grows, where a flat plan stops at its cap (see the previous situation and the cost section).
What the vendors publish
- FiveShield (publisher of this page)
Per player per day, on the daily peak: $2.25 CAD/day covers up to 50 players, then $0.030–$0.047 CAD per extra player-day depending on the tier. No subscription.
- FiveShield (publisher of this page)
One configuration block pasted into
server.cfg, then a restart: about five minutes. No DNS change, no migration, nothing to install on the machine.
You need to protect other services too
Fits OVHcloud’s base layer at the network level; Evolution Host’s generic remote service for other ports (ask what the FiveM plan includes)
Why it fits
FiveShield’s documentation describes game traffic, resource downloads and txAdmin, and no other ports, so this is not its situation. OVHcloud’s always-on layer applies to every service on its network, at the network layers. For protection of other ports above that, Evolution Host’s general remote-protection page [9] describes profiles for further TCP and UDP services, so ask whether the plan you would buy covers them.
Where it stops fitting
Network-level protection does not know your application, and a generic profile is not a FiveM filter. A website also has tools of its own (a web application firewall, a CDN), which this guide does not cover.
What the vendors publish
- OVHcloud Anti-DDoS Infrastructure
Any OVHcloud service. OVHcloud says it cannot be disabled on a service.
Its documentation says[2]
You will not move your server
Fits A protection added in front: Evolution Host, ShieldCore or FiveShield (this guide does not pick one)
Why it fits
OVHcloud’s Game protection is closed to you, so the choice is among services that sit in front of the server. The differences that matter are the ones in the checks: what each documents about FiveM filtering (check 2) and hiding your address (check 3), what you must change (check 5) and how it bills (check 6). Put the same questions to all three in writing, and run the 30-minute test with the ones that answer.
Where it stops fitting
Each of the three places a service on the path of all player traffic. If rules limit who may handle that traffic, they apply to every one of them.
What the vendors publish
- Evolution Host (FiveM DDoS Protection)
A server hosted elsewhere: its page says the service can be offered remotely with no host change, and recommends an OVH-based machine.
Its website says[8]
- ShieldCore (reverse proxy)
Its pages differ: the price table says any host (OVH advised), its FAQ says a server at OVHcloud is necessary.
- FiveShield (publisher of this page)
Any host, including a turnkey FiveM host: nothing to migrate, no DNS change.
FiveShield’s documentation says[19]
You want a contract and a phone line
Fits OVHcloud (Game server)
Why it fits
OVHcloud publishes an availability SLA for its Game servers and phone support, in business hours at its Standard and Premium support levels and 24/7 only at the paid Business and Enterprise levels. The details and their limits are below. FiveShield’s support is on Discord, and its 99.9% figure is a target rather than a contractual commitment.
Where it stops fitting
The SLA is about the server being available, not about the outcome of an attack, and OVHcloud’s terms call its DDoS protection partial. A contract is also only as good as the remedy it names: ask what you receive when it is missed.
What the vendors publish
- OVHcloud Game DDoS Protection
24/7 customer service for incident management, in English outside working hours. Phone and tickets in business hours at the Standard and Premium levels, and 24/7 at the Business and Enterprise levels, which are paid subscriptions (pricing on request). Base support is included in the service price. Its goal is a first response within 15 minutes to 8 business hours; its terms give no guarantee of intervention time.
- OVHcloud Game DDoS Protection
A 99.95% availability SLA on Game servers (server availability, not the outcome of an attack), per OVHcloud’s Game page. Its terms describe the protection as partial.
- FiveShield (publisher of this page)
A 99.9% target, not a service-level agreement: the Terms provide the service “as-is” and “as-available”. Incidents are published on a public status page.
- FiveShield (publisher of this page)
Discord, answered 24/7.
FiveShield’s documentation says[26]
What the bill looks like at 32, 64, 100 and 150 players
Published prices describe different things, so there is no ranking here. Each row takes a number of players at the daily peak and shows the plan a vendor publishes for it beside what FiveShield’s per-day rule charges, every figure in its own currency. OVHcloud includes the protection in the rental of the server, so it has no column.
FiveShield’s figures come from the same tiers as the pricing calculator and are computed when the page is built. The others are the plans each vendor published on 7 October 2026, under the tax treatment it states. Term discounts, regional surcharges and caps are on each vendor’s own price and order pages.
Scroll sideways to see every column.
| Daily peak players | FiveShield (CAD) | Evolution Host plan that covers it (EUR) | ShieldCore tier that covers it (EUR) |
|---|---|---|---|
| 32 | $2.25 CAD per day$67.50 CAD for 30 days at that peak | Level 1, up to 32 players€40 per month | Up to 100 players (smallest tier on sale)€93.99 per month, VAT included |
| 64 | $2.81 CAD per day$84.30 CAD for 30 days at that peak | Level 2, up to 64 players€80 per month | Up to 100 players (smallest tier on sale)€93.99 per month, VAT included |
| 100 | $4.25 CAD per day$127.50 CAD for 30 days at that peak | Level 4, up to 140 players€200 per month | Up to 100 players€93.99 per month, VAT included |
| 150 | $6.60 CAD per day$198.00 CAD for 30 days at that peak | Level 5, unlimited players€340 per month | Up to 150 players€140.99 per month, VAT included |
The same server in three different months
A flat plan does not care what your peak was on a given day; per-day billing does. These are three shapes of a 30-day month for the same 100-player server, priced with FiveShield’s rule. They are illustrations, not data.
Scroll sideways to see every column.
| Shape of the month | FiveShield, 30 days |
|---|---|
| 100 players at the daily peak, every day | $127.50 CAD |
| 100 players on 8 days, 60 on the other 22 | $92.30 CAD |
| 100 players on 6 days, server disabled for the rest of the month | $25.50 CAD |
A flat monthly plan costs the same in all three months while the population stays within its cap. Per-day billing follows the shape of the month, which is why it suits uneven months and does little for a steady one. In the steady month it rises with every player while a flat plan stops at its cap, so a flat plan can be the easier bill to plan. None of this says one costs less than the other: the currencies and tax treatments differ, and only your own numbers settle it.
Tax differs by vendor. Evolution Host states that VAT is included in its prices where applicable, and ShieldCore shows its prices VAT included. FiveShield’s pricing page gives amounts in Canadian dollars without saying how tax is handled, so ask before you treat the columns as equivalent.
Prices move. On the day you buy, open the price page of every vendor you are weighing; the date above is only when we read them.
The bill follows your own peaks. Try your numbers in the pricing calculator.
$10 CAD free on your first server · No card needed · Cancel anytime
When you may not need a paid service
Free measures exist, and a server nobody has a reason to attack may do well enough with only them. They shrink what you publish; they do not absorb volume.
What costs nothing and is worth doing
- Keep the address out of the listing with
sv_forceIndirectListing, and clear out old DNS records. The section on server.cfg of the FiveM anti-DDoS page says what each convar does and does not do. - Keep a website, a database and a panel off the game machine’s public address.
- Use whatever your host already includes, and read what its terms promise. This is what OVHcloud publishes about its base layer:
- OVHcloud Anti-DDoS Infrastructure
Included at no additional cost and unmetered, according to OVHcloud.
Its website says[4]
When to pay
Pay when an hour of downtime costs you more than the protection does: a server that earns, a community that drifts away after one bad night, or an adversary who has already turned up. If none of that is true today you may wait, but know what waiting costs: you will set protection up under pressure, and a setup done during an attack is harder to do carefully.
Free FiveM DDoS protection: what actually exists and where it stops lists what is on offer and where each stops.
Red flags in “best anti-DDoS” lists, this one included
Most lists like this are written by someone who sells one of the entries. These are the signs that separate a guide from an advert. Run the checklist on any list, including this one: the right-hand column says how this page does, and you should check it.
Scroll sideways to see every column.
| Sign | Why it matters | On this page |
|---|---|---|
| The publisher comes first in every table | Position becomes the product. | There is no ranking. Of the seven situations, five are answered by an option other than FiveShield. |
| No date, or a date that never changes | Prices and terms move, and an old list reads like a current one. | Three dates sit under the title, and the change log at the end records every change. |
| Numbers without a source, or one network’s capacity presented as the vendor’s own | You cannot check them, and the size of a network is not a promise about your server. | Every statement about another vendor points to that vendor’s own page, with the day we read it. Capacity figures are not repeated. |
| Star ratings or review scores the publisher gives itself | A rating the seller collects about itself tells you about the seller. | None on this page: no ratings, no review scores and no review markup. |
| Absolutes: “blocks every attack”, “100%” | Marketing and contract terms often differ. Compare them. | FiveShield’s Refund Policy itself states that no service can promise full protection against every type of attack, and that holds for each option on this page. |
| Affiliate links or discount codes next to the verdict | A recommendation that earns commission is a paid recommendation. | None. No link on this page earns anything, and the links to other vendors go to their own pages. |
| A “best” that never says best at what | A verdict with no criteria cannot be checked. | The word in the heading is the question people type. The answer is the table of situations, with its reasons and sources. |
| No word on where the author’s own product is the wrong choice | Every product is the wrong choice somewhere. | Each situation has a “where it stops fitting” line, FiveShield’s included. |
A 30-minute test before you commit
Use this on any vendor’s trial or first day. It takes about thirty minutes of your time, plus a few players for part of it and the wait for a support reply, and it tests the checks you can test without attack traffic. Do not generate attack traffic yourself.
- 0–5 min
Record a baseline
Have three players in different regions, including your furthest, send 100 pings to the server. Note the average and the gap between the fastest and slowest reply, and ask each to say how voice sounds. Join once with an empty client cache and note your host’s outbound traffic.
- 5–10 min
Switch it on as the documentation says
Use a spare server if you have one. Count the steps against what the vendor told you, and note anything you had to guess.
- 10–15 min
Join as a new player and as one already connected
Check that both get in, and ask the vendor what happens to players who are mid-session at the moment protection goes live.
- 15–20 min
Repeat the baseline
Same players, same hour, same measurements. Compare the average, the spread and how voice sounds.
- 20–25 min
Check the origin
Look at the listing with CFX Finder, check your DNS for old records, and from a phone on mobile data try the origin address on port 30120 (
/info.json) and port 40120. Anything that answers is reachable without the protection. - 25–30 min
Ask something real
Put a real question to the support channel and time the answer. Read the terms for limits, refunds and how uptime is worded. Ask for three answers in writing: what is checked on a connection, what is covered beyond the game port, and what happens above the plan’s cap.
Which vendors offer a trial
Which of these options publish a trial? This is how this guide records the answer for Evolution Host and FiveShield; for OVHcloud’s Game servers and for ShieldCore it records none.
- Evolution Host (FiveM DDoS Protection)
A free 3-day trial, for remote protection only; you request it through a form and the vendor replies afterwards.
- FiveShield (publisher of this page)
$10 CAD of free trial credit on the first server of an eligible account: about four days of protection for up to 50 players, no card needed.
FiveShield’s documentation says[19]
Frequently asked questions
Which anti-DDoS should I choose for a FiveM server?
There is no single answer, because the options solve different problems. If your server runs on an OVHcloud Game server, start with the protection that comes with it. If it runs elsewhere, the choice is between services added in front of the server, and it turns on what each documents about FiveM filtering and hiding your address, what you must change and how it bills. The table of situations on this page assigns each case to the option that fits, and five of its seven rows point to an option other than FiveShield.
Should I choose a host with built-in protection or a remote proxy?
It depends on whether you can and want to move. Protection built into a host means one invoice, one support desk and no extra network hop, but it ties protection to hosting and protects the address the server already has. A proxy in front works with the host you have and can hide the server’s address, but it adds a vendor and a hop, and it only works if the origin address does not leak elsewhere. Checks 3 and 5 are the ones to run. The two can also be combined, but whether a given pair works together is a question to put to both vendors in writing.
Do I need a paid anti-DDoS for a small server?
Not always, and the honest test is cost, not size. Free measures (keep the address out of the listing, clean up DNS, keep other services off the game machine) reduce what you expose, and your host may include a base layer. They do not absorb a volumetric flood. Pay when an hour of downtime costs you more than the protection does, or when someone has already shown they want you offline. The section “When you may not need a paid service” above goes through it.
Does Cloudflare protect a FiveM server?
Cloudflare’s standard proxy filters web traffic, and FiveM gameplay is UDP on port 30120, so putting your domain behind it protects your website, not the game server. Cloudflare also sells a product that relays TCP and UDP; what it requires and what it does not check for FiveM are covered in the FAQ of the FiveM anti-DDoS page rather than repeated here. Whatever general-purpose service you consider, apply the same eight checks, starting with check 2.
How do I test an anti-DDoS before paying?
Test what can be tested without attack traffic: round-trip time and voice quality for the same players before and after, how a new and an already connected player join, whether your origin address answers directly, what the listing publishes, how long support takes to reply and what the terms say about limits. The 30-minute test above lists the steps, and the box under it records which vendors publish a trial and on what terms.
Can I test an anti-DDoS by attacking my own server?
No. Do not generate attack traffic yourself. A flood does not stay on your machine: it crosses your host’s network and can be treated as an attack by your host, your protection vendor or the carriers in between, and paying a third party to attack anything is illegal in many countries. This is not legal advice. If you want a load test, only the vendor can arrange one, in writing, so ask whether it runs or allows one; otherwise use the checks above, which need no attack traffic.
Does a proxy hurt voice chat?
It can if the path through it is slow or uneven, and it does not have to. A proxy adds a hop, so the questions are how much delay and how much variation. Measure rather than trust: have the same players ping the server in the same evening window with and without it, compare the average and the spread, and listen to voice for five minutes. Read what each vendor’s own pages say about latency and how it measured it; treat all of it as a claim until you have measured.
Is FiveShield the right choice for every FiveM server?
No, only for some. FiveShield is the only one of the four that publishes per-day billing, which is what a few small or uneven servers billed per player call for, and it is one of three options when your server is hosted elsewhere and staying there. For the other situations on this page another option fits better. We wrote this page and sell one of the four options, so weigh the sourced reasons rather than the conclusion.
When was this guide last checked, and how do I report an error?
Every statement about another vendor comes from a source listed on this page, read on the day shown, and was last checked on 7 October 2026. The next check is due by 6 November 2026, earlier if a vendor edits a page we cite. To report an error, post the sentence and a link to the source on Discord; it is corrected and noted in the change log.
Sources and dates
Each claim about another vendor in this guide rests on one of the pages below. “Read” gives the day we opened a page, and “Page updated” the date the vendor prints on it, when it prints one. FiveShield’s own pages are included because they are the only source for what is said about FiveShield. The bracketed numbers match the ones used above.
Entries without a link are pages from companies we compete with, which we name but do not link to: search the title and domain shown to read them.
OVHcloud
- [1]OVHcloud documentation: Game DDoS Protection (Game firewall) guide
read · Page updated
docs.ovhcloud.com
- [2]OVHcloud documentation: Edge Network Firewall guide
read · Page updated
docs.ovhcloud.com
- [3]OVHcloud website: Game DDoS Protection
read
ovhcloud.com
- [4]OVHcloud website: Anti-DDoS Infrastructure
read
ovhcloud.com
- [5]OVHcloud website: Bare Metal Game servers
read
ovhcloud.com
- [6]OVHcloud website: support levels
read
ovhcloud.com
- [7]OVHcloud General Terms of Service, worldwide set (OVH Hosting Inc.), version of 17 January 2025 (articles 8 and 9)
read
contract.eu.ovhapis.com
Evolution Host
- [8]Evolution Host website: FiveM DDoS Protection
read
evolution-host.com
- [9]Evolution Host website: EvoShield remote DDoS protection
read
evolution-host.com
- [10]Evolution Host documentation: remote DDoS protection (EvoShield)
read
docs.evolution-host.com
- [11]Evolution Host documentation: managing EvoShield profiles
read
docs.evolution-host.com
- [12]Evolution Host order and trial form script (secondary source: trial conditions, form fields, term discounts)
read
evolution-host.com
- [13]Evolution Host website: FiveM server hosting
read
evolution-host.com
ShieldCore
- [14]ShieldCore website: home page
read
shieldcore.io
- [15]ShieldCore website: home page, FAQ section
read
shieldcore.io
- [16]ShieldCore website: script holding the FAQ strings (secondary source)
read
shieldcore.io
- [17]ShieldCore store: reverse proxy
read
client.shieldcore.io
- [18]ShieldCore store: VPS
read
client.shieldcore.io
FiveShield (first party)
- [19]
- [20]
- [21]
- [22]
- [23]
- [24]
- [25]
- [26]
Cfx.re
- [27]Cfx.re forum: Development Update #2, FiveM for GTAV Enhanced (1 July 2026) (opens in a new tab)
read
https://forum.cfx.re/t/development-update-2-fivem-for-gtav-enhanced/5412576
Corrections and change log
Found a mistake or something out of date? Send the sentence and a link to the right source on Discord (opens in a new tab). The page is corrected and the change is written in the log below.
The guide is rechecked at least every 30 days, and earlier whenever a cited vendor page changes. The next check falls on or before 6 November 2026.
Change log
- First published. Statements about OVHcloud, Evolution Host and ShieldCore are read from the sources listed above, each with the day it was read.
Run the test on your own server
Whatever you shortlist, run the 30-minute test with real players before you commit. FiveShield installs by pasting one block into server.cfg, which takes about five minutes, and a trial or a first day is the cheapest place to learn whether the checks above hold for your server.
$10 CAD free on your first server · No card needed · Cancel anytime
Read next
- How each FiveM attack works, and what FiveM DDoS protection has to do
- See what the listing publishes about your server (CFX Finder)
- FiveM server under attack: the first steps
- FiveM server problems: is it a DDoS or something else?
- Free FiveM DDoS protection: what actually exists and where it stops
- Pay-per-player pricing: how FiveShield bills