My guess is that on DDoS protection, javascript calculates some “cryptographic” challenge. (proof of work)