denying access to all countries or enable cloudflare is a useless move since first one means nothing and second one can be bypassed. YES attackers can bypass cloudflare's browser authorization.
Who is your provider? Does he offer any kind of ddos protection? i mean if his firewall can't handle...