I self-hosted behind a Cloudflare proxy as well. The fact is, it's impossible to fully secure a public webserver. Any motivated and resourceful attacker can find their way in.

The web (just http, not the Internet) is inherently insecure.