How to save my website from DDOS attacks.

When you are getting such attacks on your website, you need to block these IP addresses.
You can do that by using a service like Cloudflare.

Best solution is get a DDoS Protected IPs Or DDoS Protected Servers and use a Protected IP As main IP And Hide a Real IP
This way you can sortout those Things

Regards,

Actually once an attacker knows your website or server IP, cloudflare will be meaningless, as they will direct the attack directly to your web hosting IP, the only way to secure is on the server side, if your server at the hosting or data center level has DDoS protection and firewall solution that can be best, otherwise some security solutions like imunify360 also has some good DDoS mitigation solutions built in them.

I think attackers know your real server IP address. So disallow or drop all direct access to your server ip address and only allow cloudflare ips to access your ip address. This could help from ddos attack.

There are a lot of solutions for that. The one you chose will depen on the budget you have and on the protectioon level. As for me, the easiest way and the fastest is ordering a DDoS proxy.

Install wordfence and learn how to set it up

After reading through this thread.. I'm pretty sure it's not a "DDOS" or if it is, then it's a crazy weak one. It could be just a simple brute force attack (but that's also usually carried out in a different way so that it doesn't show up in Google Analytics).. difficult to say without seeing logs. As others have said use Cloudflare. You can use their firewall rules to block specific patterns, if possible.

Cloudflare MAY NOT help if they are legit-looking requests because a real DDOS is a bit different than seeing 30k visits in Google Analytics.

Receiving 30k visits within 10 minutes on shared hosting is a lot, yes. Shared hosting is not meant for such traffic loads. But you also don't need a big VPS because 30k visits per 10 minutes is just 50 requests per second.

So here's what you should do. Take a look at your server logs (available on shared hosting and a dedicated/VPS server of course). Do not look into Google Analytics because it's useless. Try to find patterns in your access logs and see if you can block requests based on patterns or maybe if it's just a couple of IPs, then block them and that's that.