Yes, I've tried cloudflare, and unfortunately, have had to shut it off as it affected too many aspects of my site. Several page blocks would not load consistently or at all. I went with the Pro account for 2 months, played with the various settings, yet couldn't figure out how to tweek enough to get things working properly. Very frustrating as I like the concept of this service.

Blocking IP addresses by typing in restrictions in httaccess file isn't a practical solution. Attackers can just see more reroute through countless proxies. I originally started using AntonLV's Access Management System 2.0 (http://www.boonex.com/m/Access_Management_System_2_0_0), however, it still requires a great deal of time to add ip addresses into the restriction areas - at this time, I don't have a solution yet.

I'm in the process of fixing potential holes in programming using GoDaddy's Website Security solution that has identified different risk levels associate with each. I'm still at 7.0.3 since everything on my site is working, and just hanging tight until 8.0 is released - hopefully that will be released in the next 3 months. Yes, wishful thinking...

Hope that helps.