How to hide Webserver IP?

I'm running Wordpress blog, I want to hide webserver IP, here they way i do:

Visitor --> Cloudflare --> Nginx reverse proxy --> Webserver Mail is disabled, use external SMTP

It looks nice, but i have a question: Can someone leak real IP when I allow them upload media in Wordpress?

http://ift.tt/1dvHQ0Z