TOR is a source of lots of DDOSing and things like that, which happen to be the exact thing Cloudflare takes money from people to protect against. From the blog

TOR is a source of lots of DDOSing and things like that, which happen to be the exact thing Cloudflare takes money from people to protect against. From the blog posts I have read in the past, it seems they appreciate TOR's existence but recognize that in its current state, it is a thorn in their side. Mitigating abuse while supporting the TOR ecosystem is an open problem and they have certainly done more than any other CDN afaik to explore ways to allow legitimate TOR users past their firewall. Unfortunately, if I remember correctly the solution involves tracking IDs which can deanonymize users. I had an idea a while back of a distributed, anonymous reputation system with rotating tokens. I still believe this is a better solution than the permanent tracking IDs currently used and maintained by other companies. It would return control to the user.