Skip to main content
For a custom backend on a US Windows server, deploy a FlashRDP Windows RDP in Phoenix, AZ: every server includes network-level (Layer 4) DDoS filtering at no extra cost. Then lock down Remote Desktop and open only your application’s ports in Windows Defender Firewall. Layer 4 filtering stops network floods; it doesn’t filter application-level (Layer 7) attacks, so plan for those separately.

Why network-level filtering matters

A volumetric DDoS attack fills the network link before traffic ever reaches Windows. Windows Defender Firewall can drop packets, but it can’t help once the link is full. Filtering has to happen upstream, in the network. FlashRDP’s DDoS protection filters Layer 4 (transport-level) floods automatically, including:
  • TCP SYN floods
  • UDP floods
  • ICMP floods
  • NTP, DNS and SSDP amplification
Layer 7 attacks aren’t filtered. Application-level attacks, such as HTTP floods or abusive requests that look like real clients, reach your application. For HTTP-based backends, put a proxy service such as Cloudflare in front, and add rate limiting and authentication in your application.

Deploy your backend securely

1. Choose the location

FlashRDP has two locations: Phoenix, AZ (USA) and Paris, France. For users in the Americas, Phoenix is the US option. Measure latency from where your clients are before you commit. Deploy a FlashRDP Windows RDP.

2. Lock down Remote Desktop (port 3389)

DDoS filtering doesn’t stop password-guessing on Remote Desktop. Follow Secure Your Windows RDP to:
  • Move Remote Desktop off the default port 3389.
  • Restrict the RDP port in Windows Defender Firewall to your own fixed IP addresses, if you have them.
  • Keep Network Level Authentication (NLA) on and use a long, unique Administrator password.

3. Open only your application’s ports

In Windows Defender Firewall with Advanced Security, allow only the ports your backend needs. For example, for a TCP service on port 8443:
Windows Defender Firewall blocks unsolicited inbound traffic by default, so anything you don’t allow stays closed. Review existing rules with Get-NetFirewallRule -Direction Inbound -Enabled True.

4. Plan for downtime anyway

No protection stops every attack. Keep backups (see the server’s Backups tab in the Billing Portal), monitor your service from outside, and check status.flashrdp.com during an incident. FlashRDP targets 99.9% uptime.

DDoS Protection

Secure Your Windows RDP

Back Up and Restore Your Server

Windows RDP Overview

Last modified on October 16, 2026