For those who have deployed Cloudflare in front, what are pros and cons? How's the user experience? Do they offer free bot protection?

Some pros for us, in addition to bot protection.

* global distributed caching of content. This reduces the static load on our servers and bandwidth usages to essentially 0, and since it is served at an end point closest to wherever the client is, they get less latency. This includes user logged in specifics as well.

* shared precached common libraries (ie. jquery, etc) for faster client load times

* Offers automated minification of JS, CSS, and HTML, along with image optimization (serve size and resolution of image specific to the device user is viewing it from) to increase speed

* always up mode (even if my server is down for some reason, I can continue to serve static content)

* detailed analytics and reporting on usage / visitors

There are a lot more, but those are a few that come to mind.

I opted for Bunny Shield exactly to combat bots, in particular ones that spoof User Agents and rotate millions of IPs. It works great, detecting the vast majority of bots and challenging them. Much more user friendly than Cloudflare too, which typically resorts to challenging everyone (not that CF was ever an option due to various concerns).

I also added various rate limits such as 1 RPS to my expensive SSR pages, after which a visitor gets challenged. Again this blocks bots without harming power users much.