We have helped quite a few people with this issue, including about a year ago ourselves when we had a 15 minute panic because the WordPress admin bar refused to disappear even though we were not logged in.
Fearing that the whole world has access to the inner workings of your WordPress site can make it quite a stressful situation, especially when the answer is not easy to be found. It is for this very reason, after helping some people with this very problem on Reddit, that we have decided to document the solution so that others can easily find it.
The Cause – W3 Total Cache
W3 Total Cache is a plugin that will cache the HTML of the page so that on subsequent page views it can be served directly from the cache rather than having to query the database or render PHP scripts. This significantly speeds up the render time of your web page as well as reducing the load on the web server. We have a very detailed tutorial on how to setup and configure W3 Total Cache along with Cloudflare, including some downloadable settings for you to import. Following that tutorial will also fix your issue.
The Solution – Change the W3 Total Cache Settings
The solution is actually very easy. Simply navigate to Page Cache Settings under the W3 Total Cache Performance Menu, and tick the box that says “
Also, to put your mind at ease, at no time would the public been able to access any of the admin functionality even though they could see the admin toolbar. All they saw was the HTML, but unless they were also logged in with the requisite user permissions they could do nothing.