luceos in my experience that's almost useless, unfortunately... Cloudflare's UAM mode is very easily bypassable, and in general Cloudflare isn't good at all at handling HTTP flood attacks. It will easily pass thousands of requests per seconds per source to the origin as if there could be something legitimate about it (and much less than this is enough to bring Flarum on a small VPS down).
In this case, however, it doesn't seem we're actually talking about a DDoS attack since there doesn't seem to be an actual denial of service.
I'm not sure I understand the last message of the user, though, so I don't really understand the problem here.
