You probably downloaded and uncompressed the wordpress archive as root and forgot to change the permissions (chown user:user -R /path/to/wordpress/public_html) for the final user that will host the website .
Cloudflare sends all the data to http:// by default even if you are using SSL so there can go things go wrong
Disable cloudflare for the moment and request a Let Encrypt certificate and enable Cloudflare again and go to SSL/TLS and set Cloudflare to full / strict