Skip to content

Halloween sale

40% off the first 2 months of any plan

Applied automatically at checkout.

Ends Nov 1, 2026, 04:55 PM UTC

06days15hr12min17sec
See sale prices

8 candies are hidden in the panel. Find them all and your free Minecraft server gets 4 GB RAM instead of 3.5 GB, for good. Plus +1 GB RAM on a paid server of your choice. Hunt in the panel

DDoS Protection for Game Servers: How Cloudflare Spectrum Shields Minecraft

Why game servers are frequent DDoS targets, how Minecraft Java (TCP) and Bedrock (UDP) traffic differ, what a proxy like Cloudflare Spectrum filters, and what you still need to handle on your own server.

Sawyer Canary · Infrastructure Lead & Systems Architect6 min readUpdated
In this guide
  1. 1. Why game servers get attacked
  2. 2. Java and Bedrock use different protocols
  3. 3. What Cloudflare Spectrum does
  4. 4. What a network shield cannot do for you

1. Why game servers get attacked

A game server publishes an address that anyone can connect to, and it has to answer quickly for players to stay in sync. That makes it an easy target: an attacker only needs the IP and port to flood it with traffic until real players time out.

Most attacks are volumetric: they try to fill the network link or exhaust the server's connection handling, not to break into the machine.

2. Java and Bedrock use different protocols

• Minecraft: Java Edition runs over TCP, on port 25565 by default. • Minecraft: Bedrock Edition runs over UDP, on port 19132 by default.

TCP floods (for example SYN floods) and UDP floods (including reflection attacks that bounce traffic off third-party services) need different filtering. A protection layer for a game host has to handle both, because many servers accept Bedrock players through GeyserMC alongside Java players.

3. What Cloudflare Spectrum does

Cloudflare Spectrum is a reverse proxy for TCP and UDP applications. Players connect to a Cloudflare address instead of the server's real IP. Cloudflare absorbs and filters attack traffic across its global network and forwards clean traffic to the server.

Two things follow from this: the server's origin IP stays hidden, and an attack has to overwhelm Cloudflare's network rather than one server's link. Every Enzonic server address is protected by Cloudflare Spectrum, including the free tier.

4. What a network shield cannot do for you

Network protection stops traffic floods. It cannot tell a real player from a bot account that connects normally. For bot joins, spam and griefing, use server-side tools:

• Turn on online mode (the default) so only authenticated Minecraft accounts can join. • Use a whitelist for private servers. • Add an anti-bot or rate-limiting plugin on public servers. • Keep the server software and plugins updated. • Don't publish your panel login or SFTP credentials, and use a strong password.

  • Never post a server's direct IP alongside the protected address. If an attacker learns the origin IP, traffic can bypass the proxy.
See Minecraft hosting plansMore guides