Always-on layer 3 and layer 4 DDoS mitigation is included on every plan at no extra cost, and there is nothing to turn on. Volumetric floods, SYN floods, UDP amplification and reflection attacks are filtered upstream of your server.
What it does not cover
Layer 7. An HTTP flood of well-formed requests, credential stuffing, slow-loris, or an expensive endpoint being hammered are application-layer problems and pass straight through, because at the packet level they are legitimate traffic. For those you want rate limiting in your web server, a WAF or a CDN in front, and caching.
Mitigation is not a reason to skip a firewall
It stops floods. It does not stop somebody connecting to the database you
left listening on 0.0.0.0. See
Cloud firewall.
During an attack
You may see higher latency or a brief drop while filtering engages. Your server does not need to do anything.
If you believe you are being attacked and it is not being filtered, open a
ticket with the destination address, the time window, and what you are seeing.
Packet captures or iftop output help.
Do not attack from here
Outbound attack traffic, whether deliberate or from a compromised server, gets the server suspended. See the Acceptable Use Policy.