.htaccess rules to stop DDoS POST flooding
Apache is really, really bad at filtering any kind of requests due to its design (by the time it can learn about the request and drop it or respond with an error, it already used a lot of resources and stuff). What I did and had a big success with was this:
Install mod_rpaf or similar in Apache and set it to accept proxy from localhost.
Install haproxy on some port like 8080, configure it in HTTP mode to proxy to Apache.
Put an ACL to drop POST requests to the URL or whatever you need to drop, acls are pretty powerful in haproxy.
Set haproxy to put the client IP in a header and configure mod_rpaf to get it from there.
Add a NAT rule to redirect the traffic from 80 to the haproxy port.
With haproxy 1.5 you can achieve the same for SSL sites too. I truly find haproxy really powerful for Layer 7 filtering like this. You could probably use nginx too but it is a bit slower, however, you have an advantage that you can use tools like naxsi for it and get a true web application firewall.