I need to test a client's website for DDoS attack performance, it has been attacked in the past and I want to know what kind of changes are the most effective, are there any good tools/services you know?

Its not close to DDoS test but I used bombardier, wrk and go-wrk for stress testing an api endpoint. They simply sends requests to given url with multiple threads and displays how much request handled, request/sec etc. Its not actually answer to your question but here is my 2 cents.

Just ask on /r/programmer if they want to attack your server 😉

@anonymus19941 hahaha that might a bit too much

@hack Yep, bombardier is what I use too, although I need something that supports random parameters in the url (like an id) to be as realistic as possible

@encrypt0r if you want random parameters/multiple urls, you could check https://locust.io . it supports python to define set of rules and IMO it's easy to use. Also it's opensource