rammichael

From the Cloudflare Support website:
Q: Why do my server logs show Cloudflare’s IPs using Cloudflare?
A: When you sign on to Cloudflare the way your logs are displayed will change because Cloudflare 
 acts as a proxy. This means that your visitors are routed through the Cloudflare network. This 
 allows Cloudflare to stop attacks before they reach your network. It also allows Cloudflare to 
 speed up page load time by more efficiently routing packets and, more importantly, caching 
 static resources (images, javascript, css, etc.) on a very fast connection. However, as a 
 result, the connecting IP will always come from the Cloudflare network.
As a result, commenters’ IP will also be masked by Cloudflare. Luckily, Cloudflare sends the real 
user’s IP in a separate header. This plugin saves it, as well as the user’s geo-location (also 
provided by Cloudflare), and displays this information in the admin panel.
Note that when the blog is served directly to the internet (not through Cloudflare), anyone can 
spoof any IP address and geo-location by specifying any value in the request headers.

Real IP and Geo for Cloudflare

The plugin saves and displays visitors' real IP and location, instead of Cloudflare's.

pipdig

Use the power of the cloud and a global CDN to restrict access to your login page.
CloudGuard brings global and cloud driven protection to your login page. Using Cloudflare’s free Geolocation service, this super lightweight plugin restricts access to your login page, allowing access to only your chosen countries. This means that any login attempts from the rest of the world will be automatically blocked.
Additionally, this plugin tracks any unauthorized login attempts and displays them on a <a href="https://wordpress.org/plugins/cloudguard/screenshots/" rel="ugc">world map</a> in your dashboard.
<h3>Main Features</h3>
<ul>
<li>Protect your login page globally.</li>
<li>Reduce server load.</li>
<li>Country based IP ranges constantly updated by Cloudflare.</li>
<li>Monitor login attempts via your dashboard.</li>
<li>Block access to the login page or redirect to a URL.</li>
</ul>
<h3>Why Cloudflare’s Geolocation?</h3>
There are other plugins which can restrict your login page by geographic location. However, these plugins use your server to detect the IP and compare this to a geographic location. This adds extra overhead to your site, takes up space on your server, and requires frequent updates to keep the IP list relevant.
CloudGuard is different. Since we leverage Cloudflare’s geolocation service, your server simply has to read the data, rather than compute and store it locally. Cloudflare does the grunt work, leaving your site safe, secure and optimized.
Note: This plugin requires that you have an account (including the free option) on <a href="https://www.cloudflare.com" rel="nofollow ugc">Cloudflare</a> with <a href="https://support.cloudflare.com/hc/en-us/articles/200168236-What-does-Cloudflare-IP-Geolocation-do-" rel="nofollow ugc">Geolocation</a> enabled.
This free plugin is brought to you by <a href="https://www.pipdig.co/" rel="nofollow ugc">pipdig</a>
Please consider <a href="https://wordpress.org/support/view/plugin-reviews/cloudguard?rate=5#postform" rel="ugc">leaving a 5-star rating</a> if this plugin has helped you.

CloudGuard

I consider it essential. You can do the same thing with Firewall Rules in Cloudflare this is highly visible in Wordpress' dashboard unlike Cloudflare's stats.

Love this plugin

Use Cloudflare's free geolocation service to restrict access to your site's login page.

Real IP and Geo for Cloudflare vs CloudGuard