Lightsail WordPress instance DDOS egress bandwidth protection.

AWS Lightsail provides basic DDoS protection through AWS Shield Standard, which covers Layer 3 and Layer 4 attacks, but does not include egress fee coverage during a DDoS attack. There is no direct way to set a cap on egress fees in Lightsail, but you can monitor bandwidth usage and set up billing alerts to prevent unexpected charges.

For enhanced protection against Layer 7 attacks, consider fronting your Lightsail instance with a self-managed ALB or CloudFront distribution, coupled with AWS WAF to block malicious traffic. While AWS Shield Advanced offers comprehensive protection and cost coverage for scaling during a DDoS attack, its $3,000 monthly subscription fee may not be suitable for all users.

It would be beneficial to review the AWS Best Practices for DDoS Resiliency to determine the best approach for your specific use case.