Use DDoS protected hosting and for extra security use cloudflare and pf as well. A good idea is to whitelist cloudflare IPs with pf and block port 80 to the rest. As web server software, nginx is best in my oppinion when dealing with attacks. I wrote this tutorial about setting up nginx with php on FreeBSD: