Order and use a custom profile

A custom profile is a DDoS Shield profile that you order as a service. It holds one protection mode, one set of rate limits and rules, and one choice of what happens when no rule matches, for every floating IP you bind to it. The Profiles tab of DDoS Shield lists your custom profiles, each with the sources blocked on its addresses and their recent attacks.

An address can also have a profile of its own, at no charge, from its Shield tab (Change a floating IP's DDoS protection). A custom profile is for addresses that should share their settings. You can block a traffic source on any floating IP, with or without one (Block a traffic source).

• A custom profile filters only the floating IPs you bind to it. It cannot filter a server's shared address (How DDoS Shield works).
• An address uses one profile at a time. When you bind an address that has a profile of its own, it moves to the custom profile, and the rules of its own profile stop applying to it.
• Every address you bind shares the profile's settings. A change on the Shield tab of one of them applies to all of them.
• The plans' descriptions name packet rates, but every plan starts with the same rate limits as any new profile (Rate limits). Set the limits you need yourself, as Change the settings shows.
• You pay on the order page. Credit on your account pays first, and a saved payment method, a new card or a wallet pays the rest (How the first payment works).

Open the order page in one of these ways:

• In the sidebar, select Security, then DDoS Shield, then Order custom profile at the top of the page. The button is on every tab, and the Profiles tab repeats it while you have no custom profile.
• On Order a service, select the DDoS Shield card under Network and security.

The page has three numbered sections, and the summary under Your order sits beside them. On a phone the summary follows the sections, and Review order at the bottom of the screen takes you to it.

1. Under Plan, choose a plan. Each card shows the plan's description and its price.
2. Choose the billing cycle with the buttons beside the Plan heading, such as Monthly. A longer term names what it saves, such as Yearly · save 20%.
3. Under Profile, enter a Profile name of up to 100 characters, such as Game servers. The profile's title on the Profiles tab is made from it, and the Shield tab of each bound address shows it. When you leave it empty, we name the profile Custom Shield followed by its service ID.
4. Choose the Protection mode. Custom, which the page starts on, applies the profile's own rate limits. Standard applies the platform's limits with your rules added (Protection modes). The order page does not offer Passthrough.
5. Under When no rule matches, choose Allow, which the page starts on, or Drop. The line under the buttons says what your choice does, such as Traffic passes unless a rule drops it.
6. Under Addresses to protect, tick each floating IP that the profile should filter. The line under an address says where it is now: On the platform scrubbing today., or It has a custom profile already. Binding moves it to this one. for an address with a profile of its own or on another custom profile. You can leave every box empty and bind addresses later.
7. Check the summary. It lists the plan with its billing cycle, the Protection mode and the Addresses, such as 2 addresses or None yet; bind them later, with Change beside each to go back to its section. The Total shows the price for each billing cycle.
8. If you have a promo code, enter it in Promo code. We check it as you type, and the message under the field says whether it applies. A code that cannot be used on this order greys out the button until you change or clear it.
9. Under Due today, read what you pay now. Under Pay with, choose Account credit when it covers the amount, a saved payment method, a new card, or a wallet such as Google Pay. We start with your default saved method.
10. Select the button under the summary. It reads Place order when nothing is due. When you pay now it names the amount due, such as Pay $15.00 and order. One click places the order and pays for it, and you stay on the page until it is done.

If the button is greyed out, the line under it names the first answer still missing or the reason we refused the order, such as This plan is sold out right now. or a promo code that does not apply, and selecting it takes you to the section that fixes it. If we refuse the order or the payment is declined, the reason appears under the button and your choices stay as they were. We never place an order twice.

Once the order is placed, its receipt page opens, titled Order placed. If the payment could not be taken after we placed the order, the invoice waits there (Pay and follow the order), and you can pay it later under Invoices.

We set the profile up once its invoice is paid, and we bind the addresses you ticked. Until then, its card on the Profiles tab shows Setting up, and you cannot bind addresses to it. The order's page updates on its own. Its title becomes Your order is ready when the profile is active, and Open profile at the top of the page then opens DDoS Shield.

The order pages for Cloud Compute, for a server on App Deployment and for Floating IPs offer a DDoS Shield profile card under Add-ons (Add products to the order). A profile you add there differs from one you order on its own page:

• It protects the addresses in that order. On an instance, those are its included public IPv4 and any floating IPs you add. On a server, it is the dedicated IPv4 address you add. On a floating IP order, it is the new address.
• It starts in Custom mode, with Allow when no rule matches.
• Its Profile name takes up to 40 characters. When you leave it empty, the profile takes the instance's or server's name.
• Until the order has an address, the card's switch stays off and the card says why: Keep the included public IPv4 first. The profile protects addresses you own. on Cloud Compute, or Add the dedicated IPv4 address first. The profile protects addresses you own. for a server.

Once it is set up, the profile appears on the Profiles tab like any other.

The tab shows a card for each custom profile that has not ended. The Addresses tab of DDoS Shield links here: while a profile has no address bound, its strip says "This custom profile protects no address yet. Bind an address to put it to work." and Bind an address opens this tab (Find your protected addresses). With none, it shows No custom DDoS profiles yet and Order custom profile.

A profile's card shows:

• Its slug as the title, such as game-servers-1043-a1b2: the name in lower case with hyphens, the service ID and four random characters. Until we set the profile up, the title is the plan's name.
• The plan, its price per billing cycle and the next renewal date, with the service's status, such as Active.
• The protection mode that the profile was ordered with, such as Custom mode. The Shield tab of a bound address shows the mode in use.
• Bound addresses: each address bound to the profile, which links to its Shield tab, with Unbind… beside it. With none, the card says No address is bound yet. The profile protects nothing until you bind one.
• Bind an address, which Bind an address describes.
• Open Billing, which opens the profile's page under the Subscriptions tab of Billing.

With at least one address bound, the card also shows:

• Blocked sources: the sources blocked on the bound addresses, with the address of each in an On column when more than one is bound. Block source… adds one and Unblock… removes one (Block a source on a custom profile's addresses).
• Recent attacks: the five latest attacks on the bound addresses. All events opens the Events tab, narrowed to the address when only one is bound (Read attack events).

Under the cards, Per-address profiles lists each address that has a profile of its own, with that profile's name and mode. Manage opens the address's Shield tab.

1. On the profile's card, choose the address under Bind an address.
2. Select Bind IP.

A message confirms IP bound to custom profile, and the address appears under Bound addresses. DDoS Shield then filters it with the profile's settings.

The list offers only your own floating IPs that are on standard protection. When none is left, the card says Every address on the account is already on a custom profile. To move an address from another custom profile, unbind it there first. To move an address that has a profile of its own, bind it with bind_ip (With the API).

1. Under Bound addresses, select Unbind… beside the address.
2. Read the confirmation and select Unbind.

A message confirms IP unbound; uses platform default scrubbing. The address goes back to standard protection, and the profile's rules and limits stop applying to it.

Blocks on the address stay in place. You can still see and remove them on the address's Shield tab (Unblock a source).

The address goes back to standard protection even when it had a profile of its own before you bound it. In that case, Customise on the address's Shield tab brings its own profile back, with the settings and rules it had.

The profile's protection mode, rate limits, rules and When no rule matches are on the Shield tab of each address bound to it.

1. Under Bound addresses, select an address. Its Shield tab opens, with the profile's name on the profile card.
2. Change the profile or its rules as Change a floating IP's DDoS protection shows.

To aim a rule at one of the addresses, enter that address as the rule's Destination prefix, such as 203.0.113.10/32. The rule then matches only traffic to that address.

The rate limits apply to each bound address on its own. An aggregate limit of 10,000,000 packets per second lets each address receive up to that much, rather than all of them together.

Under Blocked sources on the profile's card, Block source… blocks an address or a range on one of the bound addresses. The block belongs to that address: it applies whichever profile the address uses, and it stays when you unbind the address or the profile ends. Block a traffic source covers the Block a source page, the list and unblocking.

A custom profile is billed like any other service (Invoices).

Your account plan pays for some profiles on the Shield Custom Profile plan: 1 on Business and 5 on Enterprise, and none on Free or Pro (What each plan includes). A free trial of Business pays for one while it runs. The plan pays only for profiles on your own account. Every other profile plan, such as Shield Custom Profile Plus, bills at its own price.

• A Shield Custom Profile you order while the plan has room costs $0, and we waive its setup fee. This holds when you order it on its own page and when you add it to an order for an instance, a server or a floating IP. The order page still shows the usual price. Setup starts without an invoice when nothing else in the order costs money.
• When the plan has room left, such as after you move to a larger plan, it pays for your oldest active Shield Custom Profiles that cost money now.
• When your account moves to a smaller plan, the plan keeps paying for your oldest profiles, up to what the new plan pays for. The newest beyond that keep working and renew at their own price. The same happens while Pro or Business is suspended for an unpaid invoice, because the account then has the Free plan's limits.

Each change starts at the profile's next renewal, so we neither charge nor refund the period you have paid. The Price on the profile's Current plan card shows what the next renewal costs, and the Activity table records each change, such as The Business plan pays for this DDoS Shield profile from its next renewal. Nothing changes while account plans do not apply to your account (Plans open in stages).

We suspend the profile when an invoice for it stays unpaid (Failed payments and suspended services). While it is suspended:

• We set the profile to Passthrough, so DDoS Shield stops filtering its addresses and an attack reaches them in full.
• Bind IP and Unbind… fail, with a message that ends Service is not active.
• Your blocks stay on their addresses, but they do not apply while the profile is in Passthrough.

Pay the open invoice to lift the suspension. We then set the profile back to the mode its card shows, such as Custom mode, or to Custom when the card shows Passthrough mode. If you changed the mode on a Shield tab since the order, set it again there.

You can move a profile to another billing cycle of its plan on its page under Subscriptions, but not to another plan, because each plan is a product of its own (Change a service's plan). To move to another plan, order a new profile, bind your addresses to it and cancel the old one.

A profile your account plan pays for costs nothing, so it has no billing cycle to change. Its page under Subscriptions shows Your account plan pays for this service in place of Change plan….

Select Open Billing on the profile's card, then Cancel service… on the page that opens (Cancel a service). When the service ends:

• Every bound address goes back to standard protection, and the profile's rules stop applying.
• The card leaves the Profiles tab.
• Your blocks stay on their addresses, and you can still remove them on each address's Shield tab.

The card shows Setting up

The order waits for payment. Pay its invoice, and we set the profile up once it is paid.

The card shows Profile is failed, or Profile is provisioning for a long time

We could not set the profile up. Contact support with the plan and the time you ordered.

An address is missing from Addresses to protect

The list holds the floating IPs we have assigned to you. An address that you ordered but that is not ready yet is left out. Order the profile without it, and bind it once it is ready.

Could not load your addresses

The list of floating IPs did not load, and the message gives the reason. Reload the page, or order the profile and bind addresses once it is set up.

Your order was not placed with ip_service_ids must name your own floating IPs that are not terminated or cancelled.

An address you ticked ended after the page loaded. The message ends with its service ID, such as Remove 214. Reload the page and tick the addresses again.

No DDoS Shield plans on sale

Coritan does not sell DDoS Shield to your account right now. Select Contact support if you expected it, or See all products to choose another product.

Could not load the plans

The plans did not load. Select Try again, or reload the page.

An address is missing from Bind an address

It has a profile of its own, or it is on another custom profile. Bind an address explains how to move it.

An address you ticked in the order is not under Bound addresses

We skip an address that we cannot bind when we set the profile up, such as one that was cancelled in the meantime. Bind it now.

Could not bind IP: Service is not active, or the same message for another action

The profile is suspended, or we have not set it up yet. Pay its open invoice.

The profile's rate limits have no effect

The profile is in Standard mode, which uses the platform's limits. Set Protection mode to Custom on the Shield tab of a bound address.

A blocked sender still reaches an address

The profile is in Passthrough, or an Allow rule outranks the block (How a block is applied).

• How DDoS Shield works
• Change a floating IP's DDoS protection
• Block a traffic source
• Read attack events
• Order a service
• Cancel a service

The custom profile plans are the products with module_name antiddos in GET /products/. Order one with POST /services/order, as Order a service explains:

curl -X POST https://api.coritan.com/api/v1/services/order \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "product_id": 41,
    "pricing_id": 118,
    "config": {
      "profile_name": "Game servers",
      "protection_mode": "custom",
      "default_action": "allow",
      "ip_service_ids": [214, 215],
      "per_source_pps": 50000
    }
  }'

A config that fails a check answers 422 with {"detail": {"errors": [...]}}, such as protection_mode must be standard|custom|passthrough, profile_name must be text of 191 characters or fewer, or ip_service_ids must name your own floating IPs that are not terminated or cancelled. Remove 902. The API does not check the two limits, so keep them within their ranges. When you send a hostname, the card shows it as the title in place of the slug.

A profile takes no add-ons. To add a profile to an order for an instance, a server or a floating IP, put it in that order's addons, with an optional profile_name of up to 40 characters in its config. The order names the addresses itself, so an add-on whose config has ip_service_ids answers 422 with Shield Custom Profile protects the addresses in this order, so leave ip_service_ids out of its config. (Add-ons in the order).

The answer's service.id is the profile's service ID. Once we have set the profile up, GET /services/{service_ref} returns its module_data, with the profile's profile_id and profile_slug. The addresses bound to it are the ones whose protection.profile_id in GET /api/v1/client/shield/status is that profile_id (With the API).

For a profile your account plan pays for (When your account plan pays for it), its config has included_by_plan set to true and amount_without_plan set to the price it has without the plan, such as "15.00", and its amount is 0. POST /checkout/quote counts the same room as an order: a Shield Custom Profile the plan would pay for has an amount of 0.00, and its label adds , included with your plan to the product's name, whether it is the order itself or an add-on.

POST /services/{service_ref}/actions runs an action on the profile, with service_ref set to its service ID. Each action reaches only your own floating IPs and the addresses bound to this profile:

curl -X POST https://api.coritan.com/api/v1/services/1043/actions \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"action": "bind_ip", "params": {"ip_service_id": 216}}'

{"success": true, "message": "IP bound to custom profile", "data": {"ip_service_id": 216, "inventory_id": 5122, "profile_id": 58, "enabled": true, "address": "203.0.113.12"}}

Every answer has success, message and data. An action that fails can still answer 200, with "success": false and the reason in message, so check success.

With no address bound, view_alerts answers "success": true with an empty data.events and No address is bound to this profile, so it has no attack events. Read attack events with GET /api/v1/client/shield/events instead, because it covers every address on your account (Read attack events).

To block a source, send an IPv4 address or a range from /8 to /32, and the ip_service_id of the bound address to block it on:

curl -X POST https://api.coritan.com/api/v1/services/1043/actions \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"action": "blacklist_ip", "params": {"ip_address": "198.51.100.7", "ip_service_id": 214, "reason": "UDP flood"}}'

{
  "success": true,
  "message": "Blocked 198.51.100.7",
  "data": {
    "block": {"id": 881, "address": "198.51.100.7", "prefix_len": 32, "scope": "subject", "ip_service_id": 214, "reason": "UDP flood", "source": "manual", "expires_at": null, "created_at": "2026-09-26T09:12:40"}
  }
}

We store a single address as its /32 and a range by its first address, and data.block shows what we stored. A block from blacklist_ip has no expiry. To set one, or to list the blocks on an address, use the requests in Block a traffic source. You can leave out ip_service_id while one address is bound.

To remove the block, while address 214 is still bound to the profile:

curl -X POST https://api.coritan.com/api/v1/services/1043/actions \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"action": "whitelist_ip", "params": {"block_id": 881}}'

{
  "success": true,
  "message": "Removed block 881",
  "data": {
    "block": {"id": 881, "address": "198.51.100.7", "prefix_len": 32, "cidr": "198.51.100.7/32", "reason": "UDP flood", "source": "manual", "removable": true, "expires_at": null, "created_at": "2026-09-26T09:12:40"}
  }
}

The answers you can act on:

The services API reference lists every field.