Alright well.. this is a question but what "elements" should I put into my server to "prevent" a ddoss? Software? Hardware? Etc...

Firewalls.. they are the things that are going to protect you the most against hacking and DDoS attempts. Although script security is also a must have.

Depends. A good DDoS attack can kill most low even mid-range firewall(s).

If you are being really attacked by a DDoS (lot of bots) you can black-hole (take your site off-line), over-provision (get OC192 when you need T1), router filtering (drop all UDP & ICMP) on attack, inject commands (find IRC channel and tell bots to stop), DNS (round robin a ton of IP addresses) or move site.

Good luck.

The only true way to mitigate a DDoS is to have a huge pipe and a company that can actually do it.

Otherwise you pray you don't piss anyone off

My site has DDoS attack 2 times per month, I dont know why.
Some host provider refuse to host me becasue of that.
So if a hosting company say; " Sorry but your site has DDos attack problems we cant continue providing host"
what can i do?

ooh, sorry to hear that limainfinita, i wouldn't know what to do.
personally i havn't had DoS's yet, but my friend has them once about every 2 months or so, he changed his ip and it stopped for awhile but then they came back, he had to updgrade his bandwidth in the end

Lots of bandwith.

Firewall, port blocking and a hosting provider that's on the ball

In the end, all the firewalls and port blocking will not help. It is more an issue of saturation of your connection, such that the non-legit requests are the vast majority of all traffic and those real customers coming to your site get lost in the deluge.

The only real way to mitigate this problem, as a few have mentioned previously, would be getting a faster connection than those who want to take you down.

Interestingly enough, this topic was just recently covered on This Week in Tech's 'Security Now' podcast (a must for anyone who wants privacy, a firm grasp of the evils online as they popup, and the ability to protect oneself in the age where everyone has a computer).

twit (dot) tv

Originally Posted by Zepfu

In the end, all the firewalls and port blocking will not help. It is more an issue of saturation of your connection, such that the non-legit requests are the vast majority of all traffic and those real customers coming to your site get lost in the deluge.

The only real way to mitigate this problem, as a few have mentioned previously, would be getting a faster connection than those who want to take you down.

Interestingly enough, this topic was just recently covered on This Week in Tech's 'Security Now' podcast (a must for anyone who wants privacy, a firm grasp of the evils online as they popup, and the ability to protect oneself in the age where everyone has a computer).

twit (dot) tv

Having a firewall and port blocking is still better than nothing though

Originally Posted by nmau

Having a firewall and port blocking is still better than nothing though

Indeed, it should be part of any security setup. It just will not help prevent denial of service due to saturated connectivity.