Don’t forget to firewall your webserver so it will only accept traffic that actually went through Cloudflare. This is the most false sense of security one can get.