How so?

If you are on free/pro (ddos protection starts on business+ iirc) they will just pass through your A record unproxied after attacked

All plans have protection, free has lower limits but still substantial. Pro has higher limits and Business is unlimited. Given the pricing, that's very fair.

They won't automatically unproxy you without notice. If you're getting attacked, you need to pay for the level of protection you need.

> They won't automatically unproxy you without notice.

Author here. They've done precisely that to me in the past. I don't have first-hand experience with their current policies (if they have changed at all), but still hear similar stories with some regularity.

The only thing I've seen these days is Cloudflare lifting your service to "Under Attack mode" accompanied with an email saying that they will suspend your account if you toggle it off during the attack.

Since this is a core part of their business, I don't see how they would risk it with this tactic. If you have evidence, let's see the details.

Sure: https://i.imgur.com/NDDhlVc.png

Looks like it wasn't until 2013 that Cloudflare became serious about origin protection and a more universal anti-DDoS service: https://blog.cloudflare.com/ddos-prevention-protecting-the-o... https://blog.cloudflare.com/the-ddos-that-almost-broke-the-i...

I'd like to know if people are still getting that email.

X-Forwarded-For

https://support.cloudflare.com/hc/en-us/articles/200170706-H...

wrong direction. Reveals client IP to server, not server IP to client.