Cloudflare has DDOS protection which you can set to basically paranoid and once a DDOS starts then everyone will get a captcha. This limits your spend quite effectively.
And also stop me accessing the site entirely. I don't know why, but every site with CF DDoS protection set to paranoid gives me infinite captchas that I can never pass.