The CF-Connecting-IP header is how CloudFlare passes in the original IP before they proxy the connection. The list of IP addresses is who is allowed to send it, and it's up to the website owner to keep that list up-to-date (but it hasn't changed for a while).
Fixed most of the issues Pinoy Internet and Technology Forums now serve by Cloudflare Free Plan using Full SSL.
Already added some white list on csf.allow and csf.ignore, real ip forwarding on nginx.conf.