Support

We are using CloudFlare in front of our own site where we, of course, also use Admin Tools. It's actually a configuration I have long suggested in my security presentations :)

There are two things to do.

First, in your site's Global Configuration enable the Behind Load Balancer option. This tells Joomla to take into account the X-Forwarded-For HTTP header when reporting the visitor's IP address. This code used to be part of Admin Tools, but we donated it to Joomla.

Beyond that, you have create a Page Rule in CloudFlare to not cache /administrator/*. This has nothing to do with Admin Tools, you just don't want your administrator backend to ever get cached.

That's all there is to it.

Please note that CloudFlare has its own WAF. This stops the requests before they hit your server. You MAY have to disable some rules there, but that's entirely site-specific. The idea here is that if something's getting blocked, check your server logs first. If you don't see the request at all, it was blocked by CloudFlare; you need to investigate what's going on over there.