I have a question about this part:
> moving the entire hosting to CloudFlare that will do it for me ... nor do I want to route my visitors through tracking-enabled USA servers
Isn't there some EU equivalent to CloudFlare he can use?
It's hard to admit, but DDoS mitigation is an essential part of having even a simple website these days.