Most sustained DDOS attacks will cause your hosting provider to drop you. Sure, you can recover from that in 72 hours or so, but that's not as simple as "turning on Cloudflare" at that point.

Seriously: having someone in charge of your first-line traffic that is aware of today's security landscape is worth it. Even if they require an upgrade to the "enterprise plan" before actually helping you out.

But imagine right now vs you only being down. It sucks right now but most customers are aware of why and we can just say "hey its everyone, just not us". If you had a DDOS attack only on you, imagine dealing with customers then. It is a double edged sword.

> one DDOS won't kill your business

I see many people saying this but be honest, do you know this for sure or are you just guessing? I've experienced DDoS so I know I'm not just guessing when I say that if your website gets DDoSed your hosting service would just take your website down for good. Then good luck running circles around their support staff to bring your website back up again. Maybe it won't kill your business but it'll surely create a lot of bad PR when your customers find out how you let a simple DDoS attack spiral out of control so bad that your host is refusing to run your website anymore.

Honestly I'm sure I'll get some eye rolls here, but that's my compromise. DNS through Cloudflare, orange cloud if and when I need to.