[jcrawfordor]

You can also set up TLS client authentication as a more complicated but a bit more assured method of refusing connections from anyone other than Cloudflare.