Wordpress download asetup.zip file instead of opening site

hi recent incident happened in my account, my account accessed from another ip after that i changed my password and enable 2 step verification but after that my one of the main wordpress website not working when i open my website a setup.zip file is downloading instead of website open in browser, when i turn off Cloudflare from my website my website working fine

Can you check your page rules to see if there is a new rule for the zip file? If there is, then check your API tokens to make sure there are none you don’t expect and maybe rotate your Global API key

Also try checking the Redirect Rules tab for any rules you did not create.

I have the same issue and there are not rules set in my rules tab. what should I do now?