Integrate firewall with CDN
There are probably many needed enhancements to the firewall. One that would be especially helpful would be to block traffic that doesn't originate through the CDN.
For example, with Cloudflare, hackers can sometimes use historical dns records to discover your server's origin IP address. They can then circumvent Cloudflare's ddos and firewall features.
An option in the Cloudways firewall to only accept traffic through the CDN would eliminate this whole class of vulnerabilities.