That’s an exaggeration, Discourse only needs one rule to work with cloudflare, there are plenty of servers which use it with Discourse.
It’s always stuff added beyond that, such as apps and other rules which cause the problems. This week alone we’ve had a number of good examples.
Either way, Cloudflare doesn’t do anything to harden a server beyond masquerade the FQDN. Servers which which use it are easily identifiable. Assuming it affords some additional level of protection beyond the proxy demonstrates why it can lull people into a false sense of security and actually make you more vulnerable, instead of less.
They do:
> Host: community.cloudflare.com
> User-Agent: curl/7.54.0
> Accept: */*
>
* Connection state changed (MAX_CONCURRENT_STREAMS updated)!
< HTTP/2 200
< date: Sat, 10 Nov 2018 20:41:18 GMT
< content-type: text/html; charset=utf-8
< set-cookie: __cfduid=d488d0604e545aba59340201845ebb2491541882478; expires=Sun, 10-Nov-19 20:41:18 GMT; path=/; domain=.cloudflare.com; HttpOnly
< vary: Accept-Encoding
< x-frame-options: SAMEORIGIN
< x-xss-protection: 1; mode=block
< x-content-type-options: nosniff
< x-download-options: noopen
< x-permitted-cross-domain-policies: none
< referrer-policy: strict-origin-when-cross-origin
< x-discourse-route: list/latest
< cache-control: no-cache, no-store
< x-request-id: 7218028b-d2a8-47d7-87b7-3ea8887d2d90
< x-runtime: 0.180168
< x-discourse-trackview: 1
< discourse-proxy-id: app-router-tiehunter01
< strict-transport-security: max-age=15780000; includeSubDomains
< expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
< server: cloudflare
< cf-ray: 477b56d26fff5372-LAX