If I hide my server's public IP and using a DDoS protection service such as CloudFlare or DYN, does it means that my website is safe from DDoS attacks? Or can an attacker conduct DDoS attacks that circumvent the protection offered by these services?
Nothing is 100%, but this will mitigate many of them. But if enough bandwidth is thrown at the DDOS protection company then in theory you could still loose your site, that said companies such as CloudFlare are built to protect as well as possible.
Also, make sure your server/site is never referenced directly from public facing sides of the internet, otherwise attackers will attack the endpoint directly.