Until late last year that was their policy: https://blog.cloudflare.com/unmetered-mitigation/ https://blog.cloudflare.com/unmetered-mitigation/ Also they speci

Until late last year that was their policy: https://blog.cloudflare.com/unmetered-mitigation/ https://blog.cloudflare.com/unmetered-mitigation/ Also they specifically refer to volumetric mitigation' as the thing which everyone gets. The harder to deal with attacks are probably the application aware resource attacks.