What plan are you using on cloudflare? I think their top tiers (business/enterprise) are the only ones with true anti-ddos measures, at the network level. Other than that, splitting the website from the game servers will help keep the stress off either or, as they can only try and hit one at a time or have to split their resources. Also profiling the code and finding hotspots (aka 1 request causes a lot of CPU or IO stress) will prevent them from being exploited. More details on the situation/what software will be running would be helpful. Also, never give the direct server IP out, or disable cloudflare on any of the vulnerable servers. Once they can get around cloudflare its game over.