First, bandwidth. My community isn't normally a target for DDoS attacks, but it's happened a few times before (none recently) and I'd rather know for a worse-case scenario: if a server gets hit by a DDoS, how likely/easy would it be for an attacker to exceed the allotted bandwidth for the VDS plan and start running up a bill? I'm more wondering about what is done automatically, rather than what is possible to do when I'm aware we're getting hit with one, in the case that I'm unable to do anything at the time of it happening.
Second, this would likely be better fitting in the webhosting section, but as you can run a webhost off of a VDS I figure I can just add it onto this thread. In the terms of service, it says clients may not "Run an auto-refreshing script such as a "shoutbox" that causes page refreshes more frequently than once every 30 seconds" - would a plugin such as TaigaChat for XenForo be disallowed because of this? What makes me question it is this bit on the description:
Inspired by the architecture behind all good 4chan-style imageboard scripts, this system replaces the extremely server-intensive calls to a PHP script on every refresh with a static HTML file that is rewritten when someone posts a message.
This creates a level of efficiency previously only reachable by embedded IRC chatrooms or custom server software. And the best part? It works on shared hosting.
Where previously maybe 10 or 20 people could chat on a low refresh time like 1 or 2 seconds without having an effect on server load and site speed, now most servers should have absolutely no problem handling hundreds of concurrent users.

