With CloudFlare the challenge page you refer to is dependent on your security questions.  My knowledge of DDos mitigation is not great, but what I do is have the CloudFlare security settings on Low.  If I was to come under attack, I would react and put the security settings on high for the duration.

If the DDos is bad, then you may need the expensive plan that has specialist DDos protection.