I’d hire a cyber security firm. Most firms can test how your website handles under specific kinds of stress like ddos or malicious webscrapers. They can also advice you on the axtuak risks and how to mitigate them.