without moving behind Cloudflare or something like that.

I really hope it doesn't come to that. But if it does, please don't use Cloudflare. You are probably already aware of the reasons I say that but I'll be happy to elaborate (here or in private). Fastly seem to be doing a decent job protecting MetaCPAN and are clearly open to supporting Perl-related sites so they might be a decent candidate. Worth also talking to Pair if you haven't already. If they can't (or won't) keep the bad bots away from a site with their banner on it then that's not exactly a ringing endorsement of their services.