Having largely thwarted single request attacks on my wee VPS, hackers have moved to relatively light DDoS attacks (but still more than enough to swamp a tiny VPS.)
So I added a feature that looks at server load and does a variable-length delay if it crosses a reasonable threshold. Now they think they took the server down, when really the response is just coming more slowly. Then they go away and the server stays up.
So there!