[incogneat0]

Limit login attempts and ban users, that should help a little bit...also make sure passwords with lower, upper, special, and numeric characters are being used in ALL admin/mod passwords...Otherwise if someone is running rainbow tables trying to bruteforce you may end up hacked real quick...

Only things I can think of, I am not too good at security issues...Kinda why i joined this site...

[xhflhkeuhwguu34]

If you don't want your site to be resolved, don't host your email on the webserver. Or obtain a VPS/dedicated server that has protection already in front of it.

[bazookajoe]

I experienced so many issues on my site that I financially resorted to contracting with a professional server maintenance company who took multiple steps to optimize and harden my new dedicated server. Its a few bucks a month but I have had zero issues since I hired them, but I am less that a genius in security issues.

[xhflhkeuhwguu34]

First off check whether you're getting DDoSed or not.

Run "httpd status" to check Apache's status and see whether you're getting attacked or not.
If all the spots are taken up (no dots) then you might want to consider getting a basic firewall.

You can also run:

Code

netstat -n -p|grep SYN_REC | wc -l

The value given should be max. 6.
If it's above that then you're most likely getting attacked.

If the attackers don't have your server's IP (not the Cloudflare one) you might want to consider upgrading your Cloudflare account and use their advanced DDoS mitigation service. You can also switch the security level to "I'm Under Attack" which will block/slow the attackers.
To prevent brute-force and dictionary attacks make sure to:

1. Use a strong password (> 10 characters including special characters and upper- & lower case letters).
2. Log the attempts and only allow 3 attempts per IP.

[img]http://imgs.xkcd.com/comics/password_strength.png[/img]