litespeed is much faster then apache, my serverload went from 0.5-1.0 average to 0.0x-0.2. I would suggest to just try the free trial, you'll be satisfied :)

you could try Lighttpd and is free .

lighttpd doesn't offer the security features litespeed does.

yes after read a little I agree but dont see my self paying for every core in cpu if I understand right .
for now apache2 is my option maybe later if I get a extra box to test would try the free version of litespeed.

Good advice.

You should take a look at your log server log and watch the attack while it is in progress. A lot of times the attack will go after a specific part of the site. Example, an attack constantly hitting the search.php file. If you can find a pattern, writing up a perl script to automatically ban the attacking IP's (using IPTables); it can render small to medium attacks harmless.

Alfa1 is right, you can't do much if you got a DDos attack on your back. You have to wait and let it go basically.
DDOS is done in 2 phases, Intrusion and Distributed DoS. In the first phase the hackers try to compromise weak machines in different networks around the world. It is in the next phase that they install DDOS tools and starts attacking the victims machines/site.

All those companies who say they can actually stop a DDoS attacks... are lieing. If you are dealing with russians who have an army of zombies sitting on the net (Intrusion phase, they have over 10,000 servers to pound your site), you are really screwed... can't do nothing. Small timers, ya, they can be tracked and have their IP's blocked... that's pretty much what DDoS prevention companies do.

Want to see if you deal with a DDoS attack? Run this:
If more than 5 host/ip connects from the same network then its a clear sign of DDOS.
Block that network using iptables:
Use man iptables to find out more.

The secret to survive to a DDos attack is to use a good load balancer.
The only one I recommend is lighttpd. It will push the requests from specific IP's to a server who will probably crash on a regular bassis, leaving your important cluster nodes free of attacks.

I just checked you site and it seems to have gotten back to its feet. ;)