> This means we are now just using Cloudflare for DNS. But it's possible to hit this button again and re-enable Cloudflare forwarding temporarily if we find ourselves under attack, so I figure this is a good option.
Without this enabled, attackers know what your backend IP address is, so even if you enabled it later, they could continue to DDOS your IP directly, without doing a DNS lookup.
You'd only get what you want if you both re-enabled this and switched to different IP addresses.
Also the Cloudflare cookie is clearly for technical purposes, not marketing. So no consent is needed under GDPR, in my understanding. Getting rid of it didn't accomplish anything useful.
Without this enabled, attackers know what your backend IP address is, so even if you enabled it later, they could continue to DDOS your IP directly, without doing a DNS lookup.
You'd only get what you want if you both re-enabled this and switched to different IP addresses.