The best way to avoid DDoS attack is monitor the sites you host, you can be surprise that one site on your server will cause problems to the whole server.

yes you should probably get ddos protection just in case

There are certainly providers and methods that combat DDOS attacks, some better and more expensive than others, but with botnets on 4 to 6 million PCs, a large attack can still cripple most providers.

You might want to ask your provider the ddos attack rates in mbps that they would be able to block. If the attack rates are something they cant handle, then there are many ddos protection providers with features like proxy where you dont have to move out your sites from your existing provider, the ddos service provider would filter the traffic and redirect them to your server.

I am afraid of DOS attack, but now I use only software firewalls
and apache modules to prevent DOS.