i have a website and i use Cloudflare, i even bought the "Pro" package. I have set up the records correctly( i think) so you can't find my actual IP. (I am hosting the site on VPS.)

But yet my site still keeps getting DDOSed. Usually not that it wouldn't load at all but it takes extremely long to load, most of the time i get the cloudflare error 522; connection timed out and so on.

So i believe the attackers are using Layer 7 attacks to penetrate through the Cloudflare?

What would you recommend me to do? I can't afford the 200$ Cloudflare plan or any other solution that is so costly