I don't think we need ddos mitigation mitigation.
github pages behaves how i want it to w.r.t. apex domains.