Free SSL is solved. Free DDoS protection isn't.

Free SSL is the norm

Free certificate authorities such as Let's Encrypt made HTTPS a background task. Most modern hosts and CDNs now issue and renew certificates for you once your DNS points at them.

A small site should not need to buy a standard certificate. If a host charges for one, compare it with alternatives.

DDoS protection is a different thing

Sitting behind a large CDN helps. Big networks can absorb simple, high-volume floods before they reach your server.

Attacks that look like normal web requests are harder. Stopping them needs rules such as rate limiting and bot filtering, and providers often keep the more detailed controls for paid plans. Check your provider's docs for what the free plan includes.

Where free sites usually break

On a free plan, the weak point is often your quota, not your server. A burst of requests to a dynamic page can use up a daily or monthly allowance even if nothing crashes.

Some published examples: Firebase Spark limits hosting transfer to 360 MB a day, Cloudflare D1's free plan allows 100,000 row writes a day, and Upstash's free Redis allows 500,000 commands a month. Each is fine for normal use and easy to burn through in an attack or a bug.

• Cache as much as you can. Cached responses usually do not count against your compute or database quota.
• Put a rate limit on expensive endpoints, even a simple one.
• Know when your quotas reset, daily or monthly.
• Know which paid plan you would switch to, before you need it.

A sensible setup for a free site

Serve as much as possible as static files, keep dynamic endpoints few and cheap, and accept that a determined attacker can take a free site offline.

For a portfolio or docs site, that is usually an acceptable risk. If downtime costs you money, move to a paid plan with the protections you need.