Are DDoS attacks causing my lag/high ping/crashes, and how do I prevent it?

Sudden lag, high ping, or crashes feel like an attack, but most "lag" is actually server-side and unrelated to the network. This article helps you tell the difference and shows how to harden your server if you genuinely suspect a DDoS.

Is it really a DDoS?

Possibly, but before assuming an attack, check the most common cause first: server-side performance (TPS). A slow tick rate produces the same symptoms — rubber-banding, delayed blocks, timeouts — without any network involvement.

• Run a spark report (/spark profiler or /spark tps) to see where your ticks are being spent. Heavy chunk generation, entity buildup, or a misbehaving plugin/mod is usually the culprit.
• A network-level attack looks different: sudden mass disconnects or timeouts that hit everyone at once and are not matched by a TPS drop.

Our nodes include DDoS protection that mitigates most attacks automatically, so a brief blip often clears on its own.

How to harden your server

If you want extra protection on a public or growing server, follow these steps.

1. Point a custom domain at your server so you never advertise the raw IP:port to players. Pointing your own domain is free.
2. For public servers, consider a Minecraft proxy like TCPShield, which hides your real IP and filters traffic before it reaches you.
3. Keep plugins/mods trimmed and up to date so a performance problem is never mistaken for an attack.

Tip: Always pull a spark report before opening a ticket about "lag." Nine times out of ten it points straight at the real cause.

If you have ruled out TPS and still see attack-like symptoms, open a support ticket and we will investigate whether an active mitigation is needed.

Frequently asked questions

Does HumbleServers already protect against DDoS? Yes. DDoS protection is built into our nodes and mitigates most attacks automatically, so you do not need to configure anything to get baseline coverage.

Will a custom domain stop attacks by itself? It helps by hiding your raw IP from casual scraping, but it is not a full shield. Pair it with a Minecraft proxy like TCPShield if you run a large public server.

How do I know if an attack is ongoing right now? If everyone disconnects at once with no TPS drop and it persists, open a ticket. We can check node-level mitigation on our side.