DDoS protection starts with DNS protection and works as follows:
- Requests to your domain name do not come to your server, but to intermediate Cloudflare servers
- Cloudflare checks the source of the request and, if an attack is detected, the request blocked
- If the request is secure, it is passed to your server for processing.
Cloudflare has a lot of servers distributed throughout the world. They take the brunt of DDoS attacks, leaving your server safe. In addition to that: