Better buy add-on package from hosting company or use cloudflare as it will work most of the times but a professionally managed service by server provider is going to work much better.
DDoS attacks come in many different types so the label "ddos protection" needs to be read more closely. Can your hosting provider deal with application layer ddos attacks or just volumetric attacks? What size of ddos traffic can it mitigate? Engaging dedicated ddos services is ideal but having to pay for it when I hardly get attacked is hard to justify month to month. My website firewall comes with ddos mitigation (layers 3,4 and 7) so regular attacks like brute force and whatnot are blocked every other day while when I'm actually hit by ddos I don't have to worry much either