Also read CloudFlare and CORs  Whitelisting Introduction To ensure that Origin Server denies all IPs except the CloudFlare IP (this will need to be AT the server level, not cloudlfare).…
Continue Reading