I would advise you to setup mod_evasive in Apache.
From mod_evasive on Apache
mod_evasive is an evasive maneuvers module for Apache that provides
evasive action in the event of an HTTP DoS attack or brute force
attack. It is also designed to be a detection and network management
tool, and can be easily configured to talk to ipchains, firewalls,
routers, and more. mod_evasive presently reports abuse via email and
To install it in Debian:
apt-get install libapache2-mod-evasive
Edit then mods-available/evasive.conf. Your values may vary depending on how many vhosts you have on the server.
DOSPageCount 50 <---- visites to site in the given time
DOSSiteCount 500 <---- to pages
DOSPageInterval 2.0 <---- 2 seconds
DOSBlockingPeriod 600.0 <--- seconds
For enabling the new
mod_evasive configuration, you have to restart Apache.
You might also be interested in commercial services like CloudFlare or Amazon CloudFront.