General FAQs

Here are answers to general questions about Project Shield:

How does Project Shield work?

A distributed denial of service attack (DDoS) is a type of digital attack where an attacker attempts to make a website unavailable by overwhelming it with with traffic from multiple sources. Attackers often exploit thousands, or even millions, of computers and trick them into visiting a website at the same time. The resulting flood of traffic can overwhelm servers and the website goes offline.

Project Shield protects websites from attackers using technology called a reverse proxy. A reverse proxy allows websites to route traffic - both legitimate and attack traffic - through Google’s infrastructure, which lets legitimate traffic flow through and stops illegitimate traffic from reaching the publisher’s servers. Think of Google as a train conductor only letting ticketed passengers aboard.

Learn more about how Project Shield works.

Does Project Shield affect the site’s performance?

Project Shield's impact on your website can vary because website performance depends on several factors.

Some Project Shield users see better website performance because of Project Shield’s caching features. Other users see slightly slower performance as traffic passes through Project Shield. 

Advertisements typically load content directly from an ad network and are therefore unaffected by Project Shield.

Project Shield won’t affect the vast majority of video, but you should try the service on your site to determine whether it has any performance impact. If video on your site is served by another site (such as YouTube), Project Shield won’t have any effect.

If you’re invited to Project Shield, you can test the impact on a small amount of your website traffic before sending all of your traffic through Project Shield. 

Does Project Shield protect against other digital attacks (like hacking or malware)?

No, Project Shield only helps to protect against DDoS (Distributed Denial of Service) attacks. Learn more about how Project Shield works.

What data does Project Shield store?

Project Shield stores two types of data, user configuration settings and logs for traffic that is proxied through Project Shield. 

Project Shield is built on Google Cloud Platform, and both types of data are stored on Google Cloud Platform.

We use the data we collect from Project Shield for DDoS mitigation to improve the product, and to provide information to our users about their traffic. We use the site reader’s IP address and other information to evaluate whether traffic is an attack.

We only retain aggregated metrics and details about specific attacks. If you delete your site from the Project Shield dashboard, Project Shield will delete your site configuration information and will no longer collect traffic data from your site.

Google does not use the information collected from Project Shield for improving search results or targeting advertising to end users. 

Learn more about your data and privacy with Project Shield.

Can I turn it on and off?

Yes. Project Shield is turned “on” and “off” using your DNS configuration, so changes happen as quickly as any other DNS change.  

Will I know if I’m attacked?

Not necessarily. Some attacks may be absorbed by Project Shield so effectively that they don’t generate an alert. In the case of large-scale attacks that require active mitigation, we may notify affected users.

Where does Project Shield have users right now?
Project Shield has users in Europe, Asia, North America, and Africa
Does Project Shield offer a Service Level Agreement (SLA)?

No. Project Shield is a free service offered to news publishers and other qualified websites. We use reasonable effort to support Project Shield users and maintain uptime of the service.

Reasonable effort means that when you report an issue or we find issues with Project Shield's functionality, the Project Shield team will attempt to resolve the issue and/or restore full functionality. However, the team is unable to guarantee resolution, commit to providing updates, or provide an expected resolution time.

Can any person visit my website when protected by Project Shield?

Project Shield is built on Google Cloud Platform, so website visitors who cannot access Google Cloud Platform services will not be able to see website content served by Project Shield.

Does Project Shield place ads on content?

No, Project Shield doesn’t place ads on websites it protects.

Project Shield doesn’t change the content of your website in any way. It also doesn’t impact the ability for your website to target advertising or analyze ads-related data.

My site uses Secure Sockets Layer (SSL). Does that work with Project Shield?

Yes, Project Shield supports websites with SSL, such as websites with "https://."  Learn more about how to set up a site with SSL.

My site uses a bare domain. Does that work with Project Shield?
Yes, Project Shield supports bare domains (such as, versus a subdomain such as Learn more about how to set up a bare domain.


Was this article helpful?
How can we improve it?