honestly I doubt badspot is paying cloudflare $200 a month so I'm not sure why you're all trying to blame them
free or pro users of cloudflare only get
this when it comes to ddos protection, which has to be manually turned on, so that would mean, for one reason or another, badspot hasn't turned it on
and all it'd protect would be the forum, which doesn't really matter