I’ve been using Cloudflare APO for a year with Wordfence, and I’ve never had any problems with page block, even with pages that were cached by APO. If someone had not permission to access something, the block would happen at the moment the access would happen, regardless of whether there was cache on the server by apo or browser cache.
The problem is that recently, the cache has been ignoring the wordfence blocking rules under some circumstances, and allowing access to my site. Sometimes the home page opens, and shortly afterwards the wordfence block opens. But if I open a new tab and type in the name of my website, it will open normally. And if there are pages cached by APO, it is possible to access them without the blocking occurring. Blocking only works on pages that are not cached by APO.
I thought it was important to mention this here because it’s something that didn’t happen before.
APO works by caching the HTML of your pages. like a Cache Everything Page Rule, but with a cache invalidation process that will purge pages as they are updated. It also bypasses caching for pages with cookies and query strings (except for certain marketing-related ones), as that implies dynamic content.
A visitor requesting an HTML page cached by Cloudflare cannot, by definition, be blocked by a plugin’s PHP logic at the origin.
If your setup was blocking users who visited cached pages, chances are there’s an inline JavaScript in your pages that even when cached would trigger the protection mechanism.
You should contact the plugin support forum to ask whether they have recently changed their JavaScript in a way that could possibly result in the perceived change of behavior.