You can’t protect yourself from a DDoS if you don’t configure it correctly..
other analysts see evidence that some X origin servers, which respond to web requests, weren’t properly secured behind the company’s Cloudflare DDoS protection and were publicly visible. As a result, attackers could target them directly. X has since secured the servers.
By way of Wired