They do. You can do that with their WAF (and maybe without it).

https://www.cloudflare.com/waf/