I personally use Firebase for all my static sites. Completely free and fast. If you need to run some backend function they have Firebase functions which is free to a certain degree too.
The fact that you cannot put a cap on your spending is infuriating (the official AWS answer is "we do not want to break your business" (even if I want to)).
To be fair, some complaining or crying in such cases usually gets your bill reversed.
You don't mean literally distributed denial of service attack, right? It's super easy to keep serving a static resource, so I think you'd need a huge amount of traffic to put a dent in Firebase's static hosting capacity.
I've had spikes of up to 300k visitors to my Firebase blog in a month, and the bill was like $150. It seems hard to get bitten by huge surprise costs from a blog on Firebase static hosting, even if someone's using a botnet to try to drive up your bill.
Edit: Thinking about it a little more, I guess you could find the largest resource on a blog and direct your botnet to download it nonstop repeatedly, and that would be orders of magnitude more expensive than even large organic traffic.
> so I think you'd need a huge amount of traffic to put a dent in Firebase's static hosting capacity.
No, I was referring to your bill, when your resource usage spikes (really spikes, as in sustained Gbps+ traffic spikes). Many people were taken aback by the unexpected bills.
One of those stories that get posted every other month about "How I racked up $xx000 bill for Firebase" explained that they had billing alarms but they weren't exactly real time.
Also, you might be the main/only site administrator, in which case falling asleep might end up badly for you.
Example site: https://jeremyshaw.co.nz
Other than that I'm sure Github Pages and Netlify are fine, both very popular options.
Worst case you put it on Amazon S3 and get charged a fraction of a dollar every month .