How to protect wt-tracker from DDos attack?
I think in the same way as any other HTTP(S) service. Easy solution - get protection from your hosting provider. For example, I use OVH that offers free DDoS protection.
Cloudflare.
Cloudflare isn't good for WebSocket services. It has a rough limit on opened connections: https://support.cloudflare.com/hc/en-us/articles/200169466-Using-Cloudflare-with-WebSockets
No Cloudflare.
@mrlika I stand corrected, I didn't know they limited connections. Their docs are rather vague as to the 'actual' limits. Shame, I don't know why they'd do that.