When people see a “monthly plan,” they often assume the advertised price will be the amount on their next bill. In practice, the final charge may also include traffic overages, optional security features, logging, or origin egress fees.

There is no single monthly price for a DDoS-protected CDN independent of configuration and usage. The actual service charge should be calculated as “plan fee + usage beyond the plan allowance + fees for features and services not included in the plan.” To estimate your total operating cost, list related expenses such as origin infrastructure and storage separately. Mitigation capacity is not the same as usable traffic allowance, and “monthly” does not automatically mean every item is unlimited.

What makes up the monthly cost of a DDoS-protected CDN?

Break the quote into the following components before deciding whether the advertised price is close to your actual expected spend. Not every provider charges separately for every item. Capabilities already included in the plan should not be counted twice.

This breakdown reflects real billing practices. For example, Alibaba Cloud CDN separates basic services from value-added services and offers different billing methods for traffic and bandwidth. Those are rules for that specific product and should not be applied automatically to every DDoS-protected CDN plan. Alibaba Cloud CDN Billing Overview

When reviewing a quote, ask the provider to label each item as “included,” “not included,” “overage rate,” or “not supported.” A statement such as “fully featured” is not specific enough to calculate a bill.

What is the difference between legitimate traffic, service bandwidth, and mitigation capacity?

Data transfer measures total usage; bandwidth measures transfer rate

Data transfer is generally measured in GB or TB and represents the total amount of data transferred during a billing period. Bandwidth is generally measured in Mbps or Gbps and describes the rate at which data is transferred.

For that reason, “2 TB of monthly data transfer” and “100 Mbps of service bandwidth” are not directly interchangeable. With a data transfer allowance, you must also check whether peak throughput is limited. With a bandwidth plan, ask whether monthly data transfer, fair-use, or sustained-utilization limits also apply.

In purely mathematical terms, sustaining 100 Mbps continuously for 30 days would transfer approximately 32.4 TB using decimal units:

100,000,000 bit/s ÷ 8 × 30 × 24 × 3600
= 32,400,000,000,000 Byte
≈ 32.4 TB

This is only a theoretical conversion based on continuous full-rate transfer. It does not mean that a 100 Mbps plan necessarily includes 32.4 TB of data, and it does not account for protocol overhead. Actual limits and billing measurements must be confirmed in the plan terms.

Mitigation capacity is not bandwidth your website can use freely

Mitigation capacity describes the provider's stated ability or service specification for handling attack traffic. Service bandwidth describes the transfer resources used by legitimate visitors. The two must be verified separately.

For example, if a hypothetical plan lists “200 Gbps protection,” that does not mean the website can deliver downloads at 200 Gbps or that legitimate monthly traffic is unlimited.

You should also determine whether that figure represents platform-wide capacity, a per-customer allowance, or a protection specification available under defined conditions. Knowing only how many gigabits of protection are advertised is not enough to calculate the monthly cost.

Request volume and QPS are not the same billing metric

QPS measures the rate of queries or requests per second. Monthly request volume is the total number of requests processed during the billing period. An API response may be small and use little bandwidth, yet frequent calls can still result in substantial request-based charges.

AWS WAF provides a clear product example: pricing includes web access control lists, rules, and the number of requests processed, while some additional security features are billed separately. This illustrates that security features may use different metering dimensions; it does not mean that CDN07 or every provider follows the same model. AWS WAF Pricing

How are monthly plans, data transfer pricing, and bandwidth pricing calculated?

Monthly plans: subtract the included allowance, then calculate overages

For a simple plan with a fixed monthly fee, an included data transfer allowance, and a single overage rate, use the following calculation:

超额流量 = max（当月计费流量－套餐包含流量，0）
流量超额费 = 超额流量 × 超额单价
当月服务费 = 套餐费＋流量超额费＋其他未包含项目

The calculation must use the provider's definition of “billable traffic.” Total traffic shown in a monitoring dashboard and attack volume shown in security logs may not match the metrics used for billing.

Also confirm whether the allowance resets each month, whether unused capacity rolls over, and whether it can be shared across domains or regions. If a plan's allowance cannot be used in your primary traffic regions, comparing plans by total volume alone will not reveal their relative value.

Data transfer pricing: calculate regional and tiered rates separately

Under a simple unit-price model, the charge is billable data transfer multiplied by the applicable rate. If pricing varies by region or usage tier, calculate each component separately and then add the results.

Do not multiply all traffic by the lowest rate shown in a pricing table, and do not confuse the purchase price of a prepaid data package with the overage rate. A data package's expiration date, eligible regions, and order of deduction can all affect the final cost.

Usage-based pricing may be worth considering for workloads with variable traffic, but “pay only for what you use” does not automatically mean it will cost less. Peak months and anomalous traffic should also be included in the budget.

Bandwidth pricing: first determine how billable bandwidth is measured

“Bandwidth pricing” may refer to a fixed bandwidth commitment, daily peak bandwidth, monthly statistics, or another contractual method. It should not automatically be interpreted as a fixed monthly charge.

95th percentile billing is one model that requires careful review. Tencent Cloud's public CDN pricing documentation, for example, describes collecting bandwidth samples, discarding the highest 5% of data points, and using the highest remaining value as billable bandwidth, subject to contract terms, valid service days, and other conditions. Tencent Cloud CDN Pricing

95th percentile billing does not apply a 5% discount to traffic, nor does it make 5% of traffic free. Sampling intervals, valid service days, minimum commitments, measurement methods, and rounding rules must be verified in the applicable provider documentation or contract.

Short bursts and sustained peaks can affect this billing method differently. To determine whether data transfer or bandwidth pricing is more economical, apply both models to the same real traffic curve.

Sample bill: how does a RMB 600 plan become RMB 1,060?

All prices, allowances, and usage figures below are illustrative. They are not CDN07 prices and do not represent industry averages. The example assumes one region, a single overage rate, and pricing in Chinese yuan. Taxes, discounts, and tiered rates are excluded.

This example distinguishes between two amounts: the CDN service bill is RMB 1,060, while the total shown becomes RMB 1,140 after adding the origin egress fee billed by another platform. The full amount should not be described as the “monthly CDN plan fee.”

If the base plan already includes the security and logging features shown above, the additional RMB 160 should not be added. If monthly traffic does not exceed 2,000 GB, the traffic overage charge should be zero, not a negative amount.

In this illustrative scenario, with all other assumptions unchanged, increasing billable traffic from 3,500 GB to 5,500 GB would raise the CDN service charge to RMB 1,460. The budget should therefore cover both a normal month and a peak campaign month. Related costs such as origin infrastructure should be estimated separately using peak-period usage.

Use Python to verify a simple plan calculation

The following code runs locally in Python 3. It does not access an account, purchase a service, or change any service settings. Replace the parameters with the confirmed quote and usage figures:

from decimal import Decimal
# 演示数据：人民币、单地区、单一超额单价，不含税费与折扣。 package_fee = Decimal("600")
included_gb = Decimal("2000")
used_gb = Decimal("3500")
overage_price = Decimal("0.20")
security_extra = Decimal("100")  # 已包含在套餐时填0 logs_extra = Decimal("60")       # 已包含在套餐时填0 origin_egress = Decimal("80")     # 其他平台费用，单独列示
overage_gb = max(used_gb - included_gb, Decimal("0"))
overage_fee = overage_gb * overage_price cdn_total = package_fee + overage_fee + security_extra + logs_extra
print(f"超额流量：{overage_gb} GB")
print(f"流量超额费：{overage_fee:.2f} 元")
print(f"CDN服务费：{cdn_total:.2f} 元")
print(f"列示项目合计：{cdn_total + origin_egress:.2f} 元")

With the sample parameters, the output should be 1,500 GB, RMB 300.00, RMB 1,060.00, and RMB 1,140.00, respectively. This calculator applies to the simple plan model described above. Tiered pricing, multi-region deductions, 95th percentile billing, and minimum commitments must be calculated separately under the applicable billing rules.

Which charges may change during an attack?

“DDoS protection is included” and “an attack will never increase any charge” are not the same commitment. You need to verify separately how the protection service itself, processed requests, outbound data transfer, and origin resources are billed.

For example, Cloudflare's official documentation states that unmetered, always-on DDoS protection is included with every plan. That is Cloudflare's stated policy for this service. It should not be generalized to every provider, nor does it mean that all other paid features are free. Cloudflare DDoS Protection

During procurement, ask questions specific enough to support invoice reconciliation:

• Does identified and blocked attack traffic count toward legitimate traffic or request allowances?
• How are requests or traffic generated by challenges, denied requests, and other security responses measured?
• How is anomalous traffic that has not yet been classified as an attack billed, and can the charge be reviewed?
• What triggers a protection upgrade, does it require approval, and which charges increase?
• Once the agreed limit is exceeded, does the provider continue service, rate-limit traffic, suspend service, or apply blackholing?

Blackholing generally means temporarily discarding traffic to the target, which may also disrupt legitimate access. Do not focus only on whether the bill will increase. Confirm whether the cost-control action could interrupt the service.

If you plan to use security rules to reduce abnormal resource consumption, account for both legitimate users and machine-to-machine API traffic. Simply blocking all high-frequency requests can disrupt valid use. Review the coordinated use of WAF, bot management, and DDoS protection to determine which requests should be identified, rate-limited, or allowed to continue normally.

Why can a cache hit still generate charges?

A cache hit means an edge node can respond with content it already holds instead of fetching that content from the origin again. This primarily reduces origin requests and origin processing; it does not eliminate the data transferred from the edge node to the user.

Therefore, a cached response may still incur CDN charges when billing is based on edge egress traffic. If a feature is priced by processed requests, cache-hit requests are not necessarily excluded. See how CDN delivery and caching work for the underlying principles, and refer to the applicable product rules for actual billing.

The origin may also have its own bill. Alibaba Cloud's ECS public bandwidth documentation, for example, states that applicable public traffic billing scenarios charge for outbound traffic. Whether data sent from the origin to the CDN incurs a charge, and at what rate, depends on the origin product and network path. Alibaba Cloud ECS Public Bandwidth Billing

Request hit ratio and byte hit ratio must also be distinguished. Many small requests may be served from cache while a small number of large files continue to be fetched from the origin, still generating substantial origin traffic. A single overall cache hit percentage is not enough to predict the bill.

Costs can be managed by compressing images, reducing repeated downloads, and applying appropriate caching to public resources. Content involving accounts, orders, or balances should prioritize data isolation and freshness. Do not cache every response simply to reduce origin traffic charges.

How should you estimate your budget and validate a CDN07 quote?

Use actual billable usage, not just daily visitor counts

Daily visitors or page views cannot be converted directly into a monthly cost. A text-heavy page, a video stream, and a large installer download can generate very different amounts of data for a single visit.

If you do not yet have historical billing data, start with this estimate:

月CDN下行流量
≈ 每月页面访问次数 × 每次访问实际由CDN发送的数据量
  ＋ 独立下载、接口等其他CDN数据量

For example, assume 10,000 page visits per day and 2 MB actually delivered by the CDN for each visit over 30 days. Using decimal units, those page visits would generate approximately 600 GB. This calculation covers only the specified page visits; it excludes separate downloads, API traffic, automated traffic, and differences in billing methodology.

If the service is already deployed, first collect data transfer, bandwidth curves, request volume, geographic distribution, and itemized invoices for the most recent complete billing period. Then estimate a normal month and a peak-traffic month separately.

Request pricing for your actual configuration before choosing a plan tier

CDN07 offers multiple DDoS-protected CDN pricing tiers, along with configurable options for edge locations, bandwidth, and security policies. Start by reviewing the CDN07 pricing plans, then compare them with the DDoS-protected CDN service based on user locations, origin infrastructure, protocols, and protection requirements.

Evaluating network connectivity, legitimate usage, and protection requirements together reduces the risk of buying solely on an advertised mitigation figure and later discovering that the traffic allowance or included features do not fit the workload.

Ask for the proposed service in a written quote that specifies currency, billing period, included allowances, overage rates, add-on features, and support scope. Apply the same workload data to each quote. The final order should be based on the valid quote and service terms confirmed by both parties.

Confirm cost boundaries and overage actions

Before paying, obtain clear answers to the following questions:

1. Is the price a true month-to-month rate or the monthly equivalent of an annual plan? Does it include tax, and do the same terms apply at renewal?
2. How much legitimate data transfer, bandwidth, and request volume is included, and which items are billed separately?
3. Are allowances calculated by account, domain, or region, and can they be shared or rolled over?
4. How does the provider distinguish and bill attack traffic, protection upgrades, and legitimate access?
5. Are logging, security rules, certificates, additional domains, and technical services included?
6. Are usage alerts, spending limits, or upgrade approvals available, and what happens to the service when a threshold is reached?

An alert threshold should not be treated as a hard spending cap. Reporting, alerting, and enforcement may not occur simultaneously, so confirm how the selected service actually behaves. If the limiting action suspends service or switches traffic to a direct origin connection, evaluate the resulting availability and origin exposure risks. Stopping the bill from increasing should not be the only objective.

Frequently Asked Questions

Does a monthly DDoS-protected CDN plan include unlimited traffic?

Not necessarily. “Monthly” may only mean that the base fee is charged on a fixed billing cycle. Legitimate data transfer, bandwidth, request volume, and other features may still have limits. Evaluate the included allowances and overage rules rather than relying on the word “monthly.”

Can unused monthly traffic be carried over to the next month?

It depends on the plan or prepaid data package. Some allowances reset each billing cycle, while others remain available until an expiration date. Restrictions may also apply by region or product. Before purchasing a large allowance, confirm rollover and expiration rules so that unused capacity does not become wasted spend.

Will an attack always cause additional charges on a DDoS-protected CDN?

Not necessarily. Separate the cost of protection itself from any increase in requests, data transfer, logging, or related resources. Providers handle these items differently, so an attack record alone does not determine the resulting bill.

Is bandwidth pricing always less expensive than data transfer pricing?

No. The answer depends on the traffic pattern, how billable bandwidth is measured, unit rates, minimum commitments, and included allowances. Sustained, predictable transfer and short traffic bursts should be modeled separately. Monthly data transfer alone is not enough to determine which option costs less.

Why has the bill not decreased significantly even though the cache hit ratio is high?

Origin fetches may have decreased while the amount of data delivered from the CDN to users remained unchanged, or the charges may come from requests and other services. Also determine whether the dashboard shows the request hit ratio or byte hit ratio, then compare that metric with the itemized bill.

If a CDN plan includes SSL, do I still need to purchase a certificate separately?

First determine whether “SSL included” means HTTPS is supported, certificate management is provided, or issuance and management of a specific certificate type are included. Domain coverage, certificate type, renewal, and origin-side certificate requirements should each be verified separately. A general “supported” label does not determine the cost.

How can I get a CDN07 quote that more closely reflects actual spend?

Provide your primary user regions, origin location, domains and protocols, normal usage, peak traffic patterns, and known attack history, then identify the features that must be enabled. The closer this information is to the actual workload, the easier it is to determine whether the plan allowance is appropriate and calculate potential charges outside the plan.

Calculate the monthly cost before selecting a plan tier

Keep four points in mind when reviewing DDoS-protected CDN pricing:

• The advertised plan price is only the starting point. Actual charges depend on included allowances and overage rules.
• Legitimate traffic, service bandwidth, mitigation capacity, and request volume should be verified separately.
• Keep CDN charges separate from origin, storage, and other related bills before combining them into the overall budget.
• Model both a normal month and a peak month, and document the charges and service actions that apply after limits are exceeded.

If you have prepared your usage data and requirements, contact CDN07 about plans and pricing to review the proposed configuration. Confirm legitimate traffic, the scope of protection, and each additional item before setting the monthly budget and finalizing the plan.