https://blog.wpsec.com/protect-wordpress-cloudflare/
How to protect (and quicken) your WordPress instances with a reverse proxy