Cloudflare has a new article on Using Cloudflare with WordPress. Worth reading Other Cloudflare + Wordpress Articles How do I enable HTTP/2 Server Push in WordPress Speed Up WordPress and Improve Performance Hardening WordPress Security WordPress JetPack and Cloudflare Caching Static HTML with WordPress/WooCommerce How do I use WordPress Multi-Site (WPMU) With Cloudflare? Notes for Centmin Mod Nginx Usage For CSF Firewall whitelisting of Cloudflare IPs and setting up Nginx realip pass through you can setup tools/csfcf.sh script outlined at Beta Branch - csfcf.sh - automate Cloudflare Nginx & CSF Firewall setups Cloudflare API token usage is per Cloudflare account. So be aware of this as Wordpress plugins save Cloudflare API token and if your Wordpress site does get compromised, so would the Cloudflare API token be compromised and the hackers would have access to all sites added within that Cloudflare account. You probably want to have a separate Cloudflare account for the site so have unique Cloudflare API tokens. Cloudflare Enterprise plans allow for separate API tokens, but Free, Pro and Business plans do not offer this feature Expanded availability of Multi-User access.