Cloudflare DDoS Protection is a great addition to our security posture. It's easy to manage and protects our organization from downtime from potential DDoS attacks.

I mainly use Cloudflare HTTP DDoS Protection. And its really bad. Cloudflare's HTTP DDoS Protection always kicks in too late, often after a large volume of attacks has hit the origin server before the protection kicks in. And even when the protection kicks in, only a little more than 50% of the traffic is mitigated, and the rest of the attack traffic just bypasses all of the protections. Also when I contacted support, they never give you any useful help or response. I am figuring out all the proper settings and writing my own custom WAF rules, all by myself. Yet they ask me to purchase their support service.