A friend's website is connected to CloudFlare, through the domain name at least, and has WordFence installed. It was my understanding that CloudFlare has security that would block attackers, but WordFence is picking up a significant number of "Users locked out" for suspicious user names.
My friend said that WordFence is no longer needed, but with the lockouts, I realized I need more information on what operations each does at what point of the user making a request and the server sending a response. Does Cloudflare's system have functions that check the validity of requests for resources before WordPress loads? Note: my question may not be worded correctly, but I hope the meaning is clear.