Even more digging, reveals that I’m never getting a Cloudflare IP in my $_SERVER variables. And that the fallback to REMOTE_ADDR is my hosting provider.
So even though Cloudflare has added their headers to the $_SERVER variables, I’m not passing the Cloudflare IP validdation (which seems like overkill to me).
I’ve patched this for myself by disabling the IP validation in your plugin, but would like to see a more solid solution from your end ??