We don't own the server, though, if push comes to shove, we have a list of free-speech oriented off-shore servers to switch to in a crunch. All meeting our requirements, and some provide DDoS protection if that were an issue.
As for the DDoS protection, yes we have it, not sure with whom off hand, though, I don't believe it is CloudFare.