First things first, I don't need a DDoS prevention mechanism in Drupal since that is my server's job.
In all my Drupal installs, I usually hide the identity of Drupal for security reasons. Image style token (itok) is also a Drupal identifier. I tried a hack to remove
itok in 7.22, and found out
itok is not a small implementation, which may need more work to get benefit from the community after hack.
I'm just wondering if there is a better way.