You can get DDoS protection via Cloudflare, but Cloudflare comes with its own set of "problems". (They're not really problems, but they do require some idea about how a caching proxy/CDN in front of your application server will affect your site and code, and that's generally beyond the skills/experience of Free Hosting users. Up-to-date off-the-shelf software usually accommodates things well, but copy-paste tutorial code, not so much. And naive hit counters won't work properly, since most of the "hits" won't actually happen.) Free Hosting that isn't just software-as-a-service ("Please select 'Blog' or 'Forum' below") has to strike a precarious balance between "as much security as we can manage under the circumstances" and "teh codez I finded WORKS", and since they're almost mutually exclusive, it ain't easy.