Can Cloudflare effectively protect my REST API backend server if it’s exclusively used by mobile app

Specifically, when sending requests from Swift or Android, there’s no context, such as user-agent headers. Additionally, the IP addresses originate from GSM providers, which might make it difficult for Cloudflare to accurately identify traffic. Would setting WAF rules to allow only specific countries still work reliably in this scenario?
Was this page helpful?