So this horror story just dropped with a user on netlifly being charged more than 100k on a static site due to a DDoS.
https://www.reddit.com/r/webdev/s/B1fEBigUNm
I only started on render and wonder whether there’s a way to limit the max cost or whether this could also happen here? Def. don’t want to risk of having to pay $100k even if the probability is close to zero.
Is there a way to stop serving the site when a certain threshold in spend has been reached?
Hi there,
Cloudflare’s DDoS protection is currently built into Render. We don’t charge for bandwidth classified as DDoS by Cloudflare.
We do not have a mechanism to limit spend around bandwidth, but if you don’t have a credit card on your account we would suspend your service if you approached the included amount we provide.
John B
Render Support, UTC 
Thanks for the clarification John. Regarding “no credit card”, do you mean if I’m on the free tier or is there a way to actually pay you on a prepaid/credit basis without using a credit card.
We don’t actually have a ‘free tier’. We have individual accounts, which have no monthly cost, but you are still able to enter a credit card to be able to use paid services. You can still use our free instance types but you could also have some services using paid instance types as it suits you.
With no card on file, we can’t bill you so we don’t let you exceed the free allowances that we provide. Once exhausted, your services would be suspended and then resumed at the start of a new month.
If you enter a credit card, then we will bill the card for usage at the end of the month.
I would be interested in digging into this statement you made,
is there a way to actually pay you on a prepaid/credit basis without using a credit card.
Are you afraid to enter a card to be able to use paid services as you’re unsure of what you might be billed? Are you wanting the ability to prepay for credits (with a credit card as a one-off) and then burn through those safe in the knowledge you won’t receive unwanted charges?
John B
Render Support, UTC
Hello John,
Appreciate the clarification here. Can I ask why this mechanism is not available in some form? While I appreciate the assurance that your service doesn’t charge for bandwidth classified as DDoS, I am curious from a user experience perspective why a cutoff setting would not be an option.
Additionally, from what I can tell through the billing menu section, there is no option to remove a card already on file? If a card was ever on file, does it’s removal require contacting support?
Fair questions - it’s not been a priority to get something like this added.
Right now, removing a credit card does involve contacting us, but this is something that we want to get in place to give you the confidence that you can add and remove your card as you deem necessary.
Regards,
John B
Render Support, UTC
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.