clouflare is just a joke.
Web server need to have an ip public to connect clouflare so if attack aim real ip public and not clouflare ip website will be down even cloudflare protect.