Google officially said the site speed is a SEO factor which, when implemented, will affect 1% of SERP results. This gives some idea of the scope of it's relevancy. (not saying 1% is either high or low, this is all very subjective)

Having said that, beyond speed improvement, CDN provides other SEO related benefits.

I've actually just published a 2-part Blog post that investigates SEO & CDN related myths and talks about CDN and SEO benefits, I hope you`ll find it useful. it should answer all questions:

Part 1: SEO & CDN Myths
Part 2: SEO & CDN benefits

(+1)  For redirect to main category page option. I did this several time, including for a very large tourism site which had a LOT of "inventory" changes (we are talking about dozens-hundreds/day) and had great results.

One thing I would like to suggest is to look into doing 302 and removing the redirects after 2-3 month.

The reason for this is purely practical. In our case, after just a few month, we were looking at many thousands of redirects and this is not something you want to "carry around".
My suggestion allows you to still make use of link juice for removed pages and, at the same time, have a manageable redirect profile.

As a safe net you can have a generic: "404 >>> 301 >>> Homepage" rule underneath.

Putting a noindex/nofollow on an index url will remove it from SERPs, although some ulrs will still show for direct search (using the url itself as a KW) but even then they will appear as clear links without any TItle/Description details.

Using a 301 redirect will remove the old page from index, regardless of noindex/nofollow.

If you are using a noindex/nofollow for the new url - both will not show.

Hi

I`m not sure if this is the best way to go about it.

Robots.txt is commonly used for folder level disallow rules, I`m not sure how it will respond to parameters.

Having said that, there are several things you can do here:

1. You can use WMT to zero in on this parameter and  prevent it from being searched.
To do so choose Configuration>>URL Parameters, answer "Yes" to the question about content change and  
    check-in the 3rd bullet (Only URL with value...) Of course you'll need to choose "1" as the right value.

2. If this still didn't solve your issue, you might want to try using htacess + regex to prevent access by user agent.
    You can find user-agent information here Googlebot user agent list

Also, you may want to check my blog post  about some of the less known Googlebot Facts (shameless self-promotion)

Best

Igal

Didn't say it wasn't.

I`m just not sure how these rules apply to parameters, since they are not a part of the "core" URL.

(For example: What happens if I take a URL from your site, change a nocrawl=1 to nocrawl=0 and link to it from mine?
Do you have any URL sanitation rules in place to overcome that or will the page be indexed by Googlebot when it crawls my site and moves on to yours?)

Personally, when dealing with parameters, I find it easier to work with WMT so I was offering an easier workaround, (at least for me)

To tell you the truth, I would use hard-coded on page meta noindex/nofollow here (again, as parameters can be so easily manipulated).

Hi
SEO wise, there are many things to consider before on-boarding a CDN service and bot filtering is one of them.
I've covered the topic in 2 blogs posts about a year ago:

1. CDN's SEO related advantages 2. CDN's SEO related myths (and possible issues to consider)

PS: I work for CDN-based security and acceleration service provider - Incapsula.

Generally speaking, CAPTCHA based DDoS protection is not advised as it will drive away clients and DDoS bots alike.
Same goes for delay pages.

Also, DDoS attacks are swift and can bring site/server down in minutes so the manual approach is risky and probably less effective than it sounds on paper. Even if you are always near your PC, like many of us here are, you`ll still be exposed on weekends, nighttime, launch breaks, etc... Hackers know that and will exploit it. (favorite attack time - VERY EARLY Sunday mornings... )

You should also consider that DDoS can serve as a means to an end. It's often used to "soften" the protective layer to hack the database, inject the site with backdoors, deface or delete it and so on and so forth.

What you really need is a combination of auto-triggering and transparent mitigation, which shies away from intrusive mitigation methods in favor of more subtle progressive challenges (i.e. JS challenge combined with reputation and behavior monitoring).
This may sound fancy but it really this is the emerging industry standard and growing competition between vendors actually drives costs down.