One click locks a website to Cloudflare.
After that the server accepts only Cloudflare's published addresses, and only connections carrying the client certificate Cloudflare holds. Someone who finds your origin IP and hits it directly fails at the TLS handshake.
It also refuses to lock a site that would go offline, and names which addresses aren't behind the proxy yet.