I had to deal with exactly this situation a few months ago. Though there really wasn't a DDOS going on, Cloudflare - which you can activate on SiteGround - made the problem go away. (I had to submit a ticket for them to confirm the DNS change.)

I also expect that using Google's pagespeed would do the same, as the scripts and CSS are moved to Google's servers. Again, that's a one-click activation at SiteGround. On all my stable production accounts, I use this service.

My Client did do Cloudflare and the problem is still going on. what do you mean by this: (I had to submit a ticket for them to confirm the DNS change.) I don't think we did this and if it is not a DDos attack. What do you think it is?
Thanks for your help.
Elizabeth

Once the site is put into the CloudFlare DNS, you need to go back to SiteGround and open a ticket explaining your action, so they can release the domain block. (Note: in my case, the domain was registered at siteground.)

OK but before I do please look at the attached view of my clients cloudflare panel in the control panel to make sure that these are the same settings your client used. Thank you very much Elizabeth

better, even! You are using the paid level.

Here is the feedback I got when I was ticketing back and forth with them:

So now I should do this:

Once the site is put into the CloudFlare DNS, you need to go back to SiteGround and open a ticket explaining your action, so they can release the domain block. (Note: in my case, the domain was registered at siteground.) ?

ty Elizabeth

Yes - someone at SiteGround will confirm your settings (via ticket) and manually release the block. Make sure you select 'Site Down' when opening the ticket.

OK Thank you I did it. But what do you think caused the problem if you don't think It was a Ddos attack? Sitground kep telling me that it was in the underlying code... Do you have an idea what caused it if not Ddos (which was a symtomatic result)

I think in my case it was an extension making a lot of calls - unterminated loop or something. There were, among other things, several image galleries on one page - that could do it, I think.

Hi Elizabeth,

Are you still seeing attempts to access the user pages?

Cheers
Paul

where would I look to see that?

The were in spreadsheet you attached in the ticket

Cheers
Paul

I think you are referring to the error logs.. but when I go to the same spot in the control panel now I only see the window that is attached. possibly manually releasing the block
as blueshift avised me to had an effect on what I see there. see attached and thank you.

oops here is the image

Siteground should be able to provide the log prior to the cloudflare enabling