What are some effective free methods for mitigating DDoS attacks on a small website?

While 'free' protection is limited, you can use rate limiting (e.g., via .htaccess or server configuration) to restrict requests from specific IPs, implement CAPTCHAs to differentiate humans from bots, and utilize a free CDN (Content Delivery Network) with basic DDoS protection features. Regularly monitor server logs to identify and block malicious traffic sources manually.