[wanderingpixel]

I limit slow requests with mod_reqtimeout and have e.g. reduced request body limits as I don't accept large uploads.

A real sustained DDoS would probably still require upstream handling by larger infrastructure than I run.