Detection, Mitigation & Response

Detect and mitigate DDoS attacks in under 1 second, respond automatically, and keep your users informed.

All features →
1-Second Detection
Know the instant traffic spikes. PPS checked every second.
Attack Classification
Identifies 7 attack families with protocol-level confidence scores.
Node Firewall Rules
Per-server iptables, null-routes, CDN rules & scripts.
Cloud Scrubbing
Auto-divert to Cloudflare, OVH, or Hetzner on attack detection.
BGP Mitigation
Auto-deploy FlowSpec, RTBH blackhole & rate-limiting via BGP.
Multi-Channel Alerts
Discord, Slack, PagerDuty, OpsGenie, SMS, email, webhooks.
PCAP Capture
Full packet capture with AI-powered forensic analysis.
Layer 7 Detection
HTTP flood, credential stuffing, API abuse & bot detection.
Automated Runbooks
Chain mitigation steps into automated incident response playbooks.
Analytics Baselines Threat Intel & IOC Multi-Node Status Pages Correlation Audit Log Attack Profiles Flow Collection Mirror / SPAN Mode
Docs
Documentation Quick Start API Reference Agent Setup Integrations 18
Learn
Free Tools 37 Free Certifications State of DDoS 2026 REPORT DDoS Protection Landscape Buyer's Guide PDF Hackathon Sponsorships DDoS Protection Facts
Company
About Us Become a Consultant 30% Partners White Label Managed Protection Contact Us System Status
Open Source
ftagent-lite MIT NetHawk MIT
Legal
Security Trust Center Terms & Privacy
Who Uses Flowtriq

From indie hosts to ISPs, see how teams like yours use Flowtriq to detect and stop DDoS attacks.

All use cases →
Hosting Providers
Protect every node across your fleet. White-label for your customers.
ISPs & Transit
Per-node detection across your backbone. FlowSpec and RTBH in seconds.
MSPs / MSSPs
White-label DDoS monitoring under your brand. New revenue, zero build.
Game Server Hosting
Keep players online during attacks. Per-server protection at $9.99/node.
iGaming & Sportsbooks
Uptime during peak events. Automated mitigation, zero manual intervention.
VoIP & Cloud Calling
Protect SIP trunks and media servers. No call drops during attacks.
Proxy Providers
Per-node port detection and blocking. Keep exit nodes clean.
Game Studios
Launch-day protection for multiplayer backends. Deploy before launch.
Telecom Carriers
Protect core network infrastructure. FlowSpec and RTBH automation.
Esports Small Operators Routers Edge Nodes VPN Providers Media & Streaming SaaS E-Commerce Financial Services GPU & AI Cloud Healthcare Education Government Compliance
Home/Integrations/DirectAdmin
DirectAdmin 1.60+ Hook-Based Per-Package Control

DDoS Protection for
DirectAdmin Servers

Set up automatic DDoS monitoring when DirectAdmin creates new users. See a network overview in the admin panel, give each user their own protection status page, and control which packages include monitoring.

View on GitHub → Start free trial

How It Works

DirectAdmin
User created
Hooks
post_user_create fires
Flowtriq API
Node provisioned
User Panel
Status visible in DA

Setup

Three steps to DDoS protection on DirectAdmin

1

Run the Installer

Download the plugin from GitHub and run install.sh on your DirectAdmin server. It registers the hooks and creates the config file automatically.

2

Configure API Credentials

Open the Flowtriq settings page in DirectAdmin admin. Enter your Flowtriq API URL and deploy token. The plugin validates the connection immediately so you know it works.

3

Enable for Packages

Select which DirectAdmin packages should include DDoS protection. Users created under those packages are auto-provisioned. Existing users on enabled packages can be bulk-provisioned from the admin panel.

Capabilities

What the DirectAdmin integration provides

Hook-Based Provisioning

The plugin hooks into DirectAdmin's user lifecycle events. New users on enabled packages get a Flowtriq node created automatically. Deleted users get their nodes deprovisioned. No manual intervention.

Admin Network Dashboard

Server admins see a network overview page in DirectAdmin showing all monitored users, their agent status, and any active incidents. One view for the entire server's DDoS protection state.

User Status Page

Each user gets a DDoS Protection page in their DirectAdmin panel. They can check agent health, view current monitoring status, and browse their recent incident history.

Per-Package Control

Choose exactly which DirectAdmin packages include DDoS monitoring. Premium packages get protection, basic packages don't. Change package assignments at any time from the admin settings.

Agent Install Guide

After provisioning, users see a clear install command for ftagent in their DirectAdmin panel. One curl command with the deploy token pre-filled gets the agent running on their server.

JSON Storage (No DB)

The plugin stores all configuration and state in JSON files. No MySQL tables, no schema migrations, no database dependencies. Simple to install, simple to back up, simple to debug.

Add DDoS protection to your DirectAdmin server

Install the plugin and start monitoring your users' servers within minutes. No database setup, no complex configuration.

View on GitHub → Start free trial →

FAQ

Frequently Asked Questions

Which DirectAdmin versions are supported?

The plugin works with DirectAdmin 1.60 and newer. It relies on DirectAdmin hooks (post_user_create, post_user_destroy) which are available in 1.60+.

What hook events does the plugin use?

The plugin fires on user creation and destruction hooks. When DirectAdmin creates a user under an enabled package, the plugin calls the Flowtriq API to provision a node. When a user is removed, the node is deprovisioned automatically.

Can I enable protection for specific packages only?

Yes. In the admin settings, you select which DirectAdmin packages include DDoS protection. Users created under those packages get auto-provisioned. Other packages are left untouched.

Will my users see their protection status?

Yes. The plugin adds a DDoS Protection page to the DirectAdmin user panel. Users can see real-time agent status, active incidents, and recent attack history from within DirectAdmin.

How do I install the plugin?

Run the included install.sh script on your DirectAdmin server. It copies the plugin files to the correct directories, registers the hooks, and creates the configuration file. No database setup is required.

Does the plugin require a database?

No. The plugin stores configuration and state in JSON files within the plugin directory. No MySQL or other database is needed. This keeps installation simple and avoids any schema migration issues.