Cloudfare doesn't protect all my sub-domains :/

DigitalOcean and Vultr have their own network firewall. A Ubuntu server has ufw. There’s also iptables. Note that these all apply to dedicated, not shared servers.

What I did on a shared server was block anybody not showing up with a Cloudflare header: