A few days ago I noticed a CPU peak on FreeIPAPI's application servers. I Quickly checked Cloudflare and saw that the amount of requests has doubled! By doubled I mean it reached 60 million requests a day! Was it an attack?! Well, I still don't have ...

Markdown supported · ⌘↵ to post
I am not sure. You could also consider a rate-limiters based on the unique IP. It could prevent you from system outage.
Adam Patterson
I noticed that the free plan doesn't require an API key, that could be something that you may consider adding. In Cloudflare you could probably add a WAF rule for header, query string, or cookie values and if not set have CF reject the all.