I'd check this carefully and make sure you have the WAF enabled. I seemed to always have plenty of weird looking PHP and WP requests happily forwarded by CloudFlare to my servers.
Users on the Free plan have access to the Cloudflare Free Managed Ruleset, a subset of the Cloudflare Managed Ruleset.
Users on the Free plan have access to the Cloudflare Free Managed Ruleset, a subset of the Cloudflare Managed Ruleset.
https://developers.cloudflare.com/waf/get-started/