https://azure.microsoft.com/en-us/products/load-testing/#ove...
https://aws.amazon.com/solutions/implementations/distributed...
https://loadninja.com/features/
Most hosts don't protect you from DDOS automatically, CloudFlare provides some level of protection for free now. You'll have to check with BlueHost to see if they have anything. Otherwise, I think you can sign up for CloudFlare's service even if your site isn't hosted there.
https://www.cloudflare.com/ddos-hub/#DDoS-Page-Pricing-AS
For other common security exploits as well as mitigations, you're probably looking for the OWASP Top 10: https://owasp.org/Top10/
Testing for this sort of thing falls under the realm of vulnerability scanning tools for the languages you are using. Several OWASP projects aim to make this easy and are implemented in many common languages, especially Dependency-Check, FindSecBugs, and APICheck.
You can dig through those projects or go looking for "<language> findbugs/findsecbugs/vulnerability scanner/etc". There are also commonly tools available for codified password detection, dead-code checks, and data-flow analysis, on top of the often used find-bugs and style guide checkers. Several widely used repositories, such as JFrog, provide scanning for stuff you upload and it's dependencies. SonarQube is also a big player in this space with integrations for many repos and CI/CD tools.
https://jfrog.com/knowledge-base/best-practices-for-package-...