Yea, there are a lot of "False Positives" with cloudflare. And anyone saying they are using it for DDoS protection has no idea how CF works. You really don't get any real DDoS protection unless you pay that $200/m "starting" price.
There's a setting to set how strict Cloudflare is with users. If it's too strict by default, then turn it down. It seems to vary depending on the site. Plenty of large sites, including Discord, use it without problems.
You will be surprised by how much of the web actually uses Cloudflare. Just about every actual serious site, from what I've seen, with the occasional exception.
And layer 7 attacks aren't really that much of a concern, if you've configured a server properly with the appropriate IP rate-limits. Also, pick a faster stack where possible rather than a legacy one, if this is a big problem.
For instance: Python instead of PHP.
And for 99% of sites, you will never get DDoSed, so this isn't really a concern most of the time. For *real* DDoS protection, there's always Amazon AWS and similar.
CloudFlare is shit.
How to properly do transfers with only 10 mins of downtime would be to transfer all the files over to the new VPS. Once that is done, put the forums in maintenance mode. Transfer the database over, and on the current web host, use remote MySQL for the current forums to use the new database in the new VPS. Then uncheck maintenance mode. Update DNS settings.
Now regardless if you are on the old or new DNS you can access the site no problem.
Slow and insecure. Every query is going to go from one server to another who knows how many thousands of miles away (it really depends). These will result in fairly big slowdowns for 48 hours or so.
Cloudflare is the easiest and most painless way to do things and it covers the most scenarios. Be sure to set the timeouts on the server properly though, like in the instructions, or you might get server errors.