Old post but regardless, if you just use cloudflare and no other protection at all you're nothing more than a sitting duck, CF is protection trough obscurity and that's one of the weakest forms of protection.
I do use CF and alot of people do aswell and it's great, no question on that, it speeds up your website, acts as a reverse proxy and even has a BIC if you enable it but that's just it.
If you want protection you need a good hosting company that has protection agaisnt DDoS ( OVH is great ) and you need to learn some basic defense mechanics so you don't wait on your host to just do everything.