Cloudflare has guides on several different approaches for preventing access from non-cloudflare IP addresses[1], I’m pretty sure they also direct you to this information as part of the setup process for new domains. For paying customers who aren’t technical they also offer “cloudflare tunnel” which is very simple to set up [2]. It would be nice if cloudflare has automation to proactively checked and reach out to paying customers who do have their servers exposed though. [1] https://support.cloudflare.com/hc/en-us/articles/200170166-B... [2] https://www.cloudflare.com/products/tunnel/