The problem with DDoS is the fact that you can't really prevent it much. Somebody has to take the hit, be it your server, or somebody sitting in between (like cloudflare, for example). Yup, you can minimize it to a certain extent.
I suggest changing your host from Closte to a provider that offers DDoS protection/bandwidth. That's the only way AFAIK.
P.S. Not to mention, I feel sorry for your business man. You deserve better. Not sure why on earth anyone would target you (Perhaps an angry theme developer? lol).