For what it’s worth when you set up your site on cloudflare you get to choose how strict you want security to be and what URLs it applies to, or just disable it and use it only as a CDN.

It would be nice if they were more clear that enabling some features might block legitimate users though.