how much should i pay for ddos protection?

Getting quotes for DDoS protection and the range is huge — from $50/month to $500/month for similar-sounding protection.

Is the expensive stuff actually better, or am I paying for the brand name?

The question is what kind of DDoS you're protecting against.

Layer 7 (HTTP floods) can be mitigated with Cloudflare for free. Layer 3/4 (volumetric attacks) require network-level filtering that costs real money.

Attack type	Free tier	Paid protection
L7 HTTP	Yes	Yes
L3/4 UDP	No	Yes
Multi-vector	No	Yes

If you're worried about script kiddies, free protection is fine. If you're worried about state-level actors, you need enterprise-grade.

most sites don't need enterprise ddos

Depends what you're running, but for most grey-area sites, Cloudflare Pro ($20/month) is sufficient. The $500/month options are for targets that get attacked regularly by serious actors.