The baseline that costs nothing
Putting a CDN/reverse-proxy in front of the origin server — Cloudflare's free tier is the common default — absorbs a huge share of basic attacks before they ever reach your actual hosting, since the CDN's network is sized to handle traffic spikes your own server isn't.
Rate limiting (capping how many requests a single IP can make per minute) and a web application firewall rule set catch a lot of automated, low-sophistication traffic floods without needing a dedicated anti-DDoS product at all.
When to pay for dedicated protection
Sites running e-commerce, handling payments, or operating in a competitive/adversarial niche (gambling, crypto, anything with active competitors who might target you) are worth budgeting real anti-DDoS spend for — Cloudflare's paid tiers, AWS Shield, or a specialized provider, depending on scale.
The signal that it's time to pay: your free-tier CDN starts showing attack traffic in its dashboard that it's absorbing anyway (a good sign it's working), but you also see actual downtime or degraded performance during those spikes (a sign the free tier's limits are being tested).
Beyond DDoS: baseline site security
HTTPS everywhere (not just the login page), current CMS/plugin versions, and basic security headers (Content-Security-Policy, X-Frame-Options) close off the most common, automated attack vectors — most site compromises are opportunistic scans finding an outdated plugin, not a targeted attack.
None of this is optional once a site has any real traffic: an attacker doesn't need a reason to target you specifically, and both DDoS floods and routine vulnerability scans run constantly, automated, against essentially every public IP on the internet.