It's confusing. Thought it was something sandboxed.

Why peope saw he mansplaining beside sarcasm? I mean, I didn't even notice about it before it was a thing. I just always ignore annoying people, that's all.

What about mTLS? Since you are already on Cloudflare, you might consider their client cert feature, which blocks all incoming traffic without the cert. However, you do have to manage it and set it up on all your devices.