For what it’s worth when you set up your site on cloudflare you get to choose how strict you want security to be and what URLs it applies to, or just disable it and use it only as a CDN. Or even disable routing entirely and use it only as your DNS.

It would be nice if they were more clear that enabling some features might block legitimate users though.