Plenty of non-profits have been ddosed. Your website is either small or is just lucky to have an audience that isn't inclined to ddos.