Cloudflare is an industry leader in website security, but how well does it work on a typical hacking scheme?

Do you need a content security police? And if you do, how should you add it to your website?