[Satan]

There is no way to stop a DDOS
You can use services like cloudflare witch simply doesn't let the ddos attack touch your server, but if the attack is strong enough  it will take down cloudflare witch would result in the users not reaching the site...

Whitelisting, blacklisting, migitation, analysis, etc.

Stopping does not mean ending the attack, it is to prevent it from taking you offline.

Have your friend invest in ddos protection.

Many services, including Cloudflare, offer it.