Protecting against DDOS attacks depends greatly on what your server configuration is like. Are you hosting on a shared or managed server? Then tell the company you are renting from that you think you are being DDOSed. You are paying them to do the hosting let them.
If you have a VDS or a Dedicated Server that you admin then you are going to have to work the problem out yourself. To start you might want to read up on
mod_security and
suhosin which will be a start to securing your server.
Nothing beats a hardware firewall though, if you can get your datacenter to put one in for free then that would be the best solution.