One box catches an attacker the hard way; the rest of your fleet relearns it from scratch. Swarm fixes that with a self-hosted reputation network — a Cloudflare Worker and D1 hub you own, your boxes sharing only their confirmed permanent bans, every local safety gate still in force. The network effect, without a global pool or a third-party phone-home.
Firewall your origin to Cloudflare's ranges and certificate renewals quietly die — and the intuitive /.well-known/ firewall carve-out can never save them, because a packet-content match can't admit a new TCP connection. A production post-mortem, and the two postures that actually work.
fail2ban doesn't work the way you expect behind Cloudflare — and a wrong rule can take your sites offline. A practical, plane-by-plane guide: see the real IP, block proxied attackers at Cloudflare, block direct-to-origin ones at CSF, and decide which is which.
If someone finds your server's real IP, they can skip Cloudflare entirely and hit your origin on port 443 with a valid Host header — past your WAF, rate limits, and bot management. How the origin bypass works, how to detect it, and how to lock it down.
A fair comparison for a cPanel + Cloudflare admin: architecture, Cloudflare-plane awareness, footprint, threat intel, and which of the three actually fits your server.
An abuse blocker is only as good as its decisions. How Swatter turns web-log behavior into a 0–100 score, why a blended score plus decisive floors catches focused attacks a plain average would hide, and why demanding failure evidence keeps it off your real visitors.