Show site owners cloudflare isn't doing the job they are paid to do.
Care to provide details or source?
If you add additional piece to chain, chain becomes weaker, not stronger
> get AI-DoSed
Thats not that common. There are specific industries prone to DDoS, like gaming, but your average site don't get DDoS-ed. Then again CF free service really don't protect your site from DDoS. I have seen several times CF becoming source of DoS (not caching or denying malicious requests) and if back-end is on shared infra, CF goes to firewall.
> will have an expired cert.
Your back-end still needs certificate
a kludge might be better than none. And it's an easy kludge (for the site owner - a checkbox in cloudflare).
The fault lies with cloudflare implementing a lazy bot detector.
WTF?
Building a WAF that has zero false positives and zero false negatives is impossible. All we can ask is that the companies that build WAFs be responsive, but they also need accurate bug reports with sufficient information to identify the variable.
> Designing a site to not be affected by bots is fixing the problem.
Bots footprint is minimal and shouldn't affect your site performance.
- scraping & content theft
- spam & fake engagement
- DDoS attacks
- Ad fraud
It is definitely always possible.
> may not be affordable
You hired the wrong person / people, then.
> may degrade the overall user experience
Which is exactly what Cloudflare does, although most people would make a distinction between degrading an experience and outright causing something to not work at all.