Edit: Some numbers, most of them are between 2k-5k requests per second. But we had some with 20k-30k rps.
The biggest thing we do to help ourselves when we're under attack is making sure that the pages being ddosed (homepage, etc) is being cached by them. There will always be some requests that CF doesnt block, so the cache ensures they get served by them.
What about pages which can't be cached? For example an updated comment feed? How would you deal with dynamic data?
If they attack a dynamic page, check if you can cache them for 30 or 60 seconds. Pretty close to real time.
If you have cookie based authentication for those pages, its going to be difficult to cache them at all though. Which is where SPAs come in useful since auth is client side.
https://www.cloudflare.com/en-ca/learning/cdn/caching-static...
120TB of that is our CDN backed by a Cloud provider, we had to only pay them for 3TB in bandwidth charges.
During peak traffic they serve 35% of our pages because of their cache, with some site improvements we will be able to up that to 60% soon.
Edit: I must add that we are on the Pro plan and do use multiple paid features like Workers and Load Balancers.
Besides its not like we're not paying them anything, our monthly bill with them is $1k+