>> but if this is the first DDOS they've suffered it might not have been particularly worth it to them until now. Isn't that the whole point of using a prevent

>> but if this is the first DDOS they've suffered it might not have been particularly worth it to them until now. Isn't that the whole point of using a preventative approach when it comes to your site's security? So you don't learn the hard way? Of course knowing a lot of InfoSec guys, they can only tell them what they should have, it's up the owner's to make the call to get it in place. I don't know how many times one of them complained about doing a pen test on someone's site, making the recommendations and then one year later, they haven't fixed anything yet.