robots.txt should never be considered as a valid way to prevent anything. It’s more of a complimentary standard for nice bots like search engines. Attacks won’t bother with this at all.
Again as Greenreader9 said you will not be able to carry this out in free hosting. Your only option is using Cloudflare with a custom domain.
I believe that you didn’t fully understand how Cloudflare works with our hosting so you may have skipped some steps.