Is it the proper response for the hosting company to change the IP when a DOS attack occurs? I switched from a company that used to shut down the servers in similar occasions
I can't see you gaining any advantage with an IP address change because 1, an IP address change causes your website to not be ready until the domain name TTL expires which may take several days. and 2, serious hackers will scan every single IP on the internet for systems that can become easy targets for attacks. Shutting down the server might be a better idea, depending on the attack.
What can I do to defend myself from this happening again. Although a small company, until now I had a stellar reputation. I don't want this to happen again.
Check your system resources and websites.
Make sure the web server software is running efficiently
Make sure your web server doesn't have a timeout setting that's too high, and make sure your scripts running on your server do not lag (for example, don't execute a script that contains an infinite loop).
In apache, there is only x number of open slots available to process scripts. Once all these slots are used up, then further connections to apache will have to wait until a slot is freed. Slots are freed the moment that either a timeout occurs or the moment the last byte of a result (HTML page or image or raw code, etc) is sent.
The value for x is important. If set too low, then guests could be waiting longer than usual for a page to be served, especially if one guest downloads a file several gigabytes in size. Remember, each resource requested uses one server slot. For a typical page, this means 3 slots could be used at once for roughly 200 milliseconds each. One slot for the HTML, one slot for the website icon (favicon.ico?) and one for an image in the page.
If x is set too high then the feeling of DOS may occur even more because then swap memory (memory from the slower storage space: the hard drive) will be required since the system will run out of actual RAM while trying to handle requests.
There are only so many ports a server can have open at once.
Some servers out of the box are configured to open a very limited number of ports. Increase the range as much as possible without overlapping ports used by other system daemons. I have a server with WHM/cpanel, and I set my port range to 5000-65535.
Pay attention to your scripts and watch your timimg.
When you make a page, go on webpagetest.org and run the URL through it. Choose the Native connection setting under connection speed and if the time to first byte is over 400ms from the farthest point away from your server and the remote device is not mobile, then you know you're in trouble.
Also, as I said, check all your scripts on your server. Make sure none of them run an endless loop or otherwise hog resources. Also, check server override files (such as .htaccess if you're using apache) for anything malicious.
Finally, secure everything. Close ports (by dropping requests to it) that the world does not deserve. I closed off the MySQL port (just in case anyone wondered why their face went red when endlessly trying to access my MySQL server).
The only port all users should have access to is port 80, the web server port.
Only open other ports if necessary. And definitely close port 22 and 23 since hackers know those as the standard back-end shell access ports. In fact, if you need shell access, use a different port.