Some of you may regularely see application layer attacks on your sites that are behind CloudFlare, apparently L7 attacks are usually the only attacks that can shutdown a site covered by CloudFlare (if you don't leak your origin IP).
The normal solution for these attacks is to go to the CloudFlare control panel and enable "I'm under attack" mode, but what if you're not online to do this or if you don't instantly notice an attack is coming in? It gets even worse: If the attack runs for a long time without you taking any action, CloudFlare will temporarily route all traffic directly to the origin IP (exposing it to the attacker). You'd have to watch your sites for attacks constantly to not risk getting temporarily routed directly to your origin IP. That's why I created a simple script to automatically turn CloudFlare's DDoS protection page on/off in case of an attack.
You find the script with detailed instructions here: https://vpsaddicted.com/script-enable-disable-cf-ddos-protection/
Regards
tr1cky