And cloud flare can block some of the mischievous web traffic too
Do you have your origin whitelisted to cloudflares edge ranges? If not it can be hilariously easy to get around cloudflare (ex: Hamas.ps is behind cloudflare but runs on Hetzner https://censys.io/ipv4?q=hamas.ps)