Cloudflare sits between your visitors and your site, accelerating delivery, blocking attacks, and protecting against downtime. The free tier alone solves problems most bloggers don’t even realize they have. This post is the practical setup guide, covering what’s genuinely worth configuring and what you can safely skip.
What Cloudflare does
Cloudflare works as a reverse proxy. Visitors hit Cloudflare first, and Cloudflare only reaches out to your actual site if it doesn’t already have a cached response ready.
Its core functions include:
- CDN: caches static assets like images, CSS, and JS at global edge locations close to your visitors.
- DDoS protection: absorbs and filters attack traffic before it reaches your server.
- Web Application Firewall (WAF): blocks malicious requests automatically.
- SSL: free SSL termination out of the box.
- DNS: fast, reliable DNS hosting.
- Analytics: visitor data and threat-blocking statistics.
All of this comes included on the free tier, which is unusually generous compared to most competitors.
Setting up Cloudflare
Step 1: Create an account
Head to cloudflare.com and sign up.
Step 2: Add your site
Enter your domain, and Cloudflare will scan your existing DNS records automatically.
Pick the Free plan to start.
Step 3: Verify DNS records
Cloudflare lists the DNS records it detected. Double-check a few things:
- The A record points to your host’s actual server IP.
- MX records for email are correct.
- TXT records, including SPF and DKIM for email authentication, are present.
- All your subdomains are included.
If anything’s missing, add it manually before moving on.
Step 4: Change nameservers
Cloudflare gives you two nameservers to use, something like chris.ns.cloudflare.com and liz.ns.cloudflare.com.
Update your domain’s nameservers at your registrar, whether that’s Namecheap, Cloudflare Registrar, or elsewhere, to point to these two.
Propagation typically takes anywhere from 5 minutes to 24 hours, though it’s usually on the faster end of that range.
Step 5: Configure SSL
In Cloudflare, go to SSL/TLS, then Overview, and set encryption to “Full (strict).”
This requires your host to already have a valid SSL certificate of its own, and Let’s Encrypt works fine for that. Without this step, you’ll default to “Flexible” SSL, which is meaningfully less secure.
Essential free-tier settings
SSL/TLS
- Encryption mode: Full (strict).
- “Always Use HTTPS”: on.
- “Automatic HTTPS Rewrites”: on.
- Minimum TLS Version: 1.2.
Caching
- Caching Level: Standard.
- Browser Cache TTL: 4 hours, or “Respect Existing Headers.”
- Enable “Always Online,” which serves a cached version of your site if it ever goes down.
Speed
- Auto Minify: on for HTML, CSS, and JS.
- Brotli: on.
- Early Hints: on.
- Rocket Loader: test this one first, since it can break some sites. Many WordPress sites benefit noticeably; a smaller number break in ways that aren’t always obvious right away.
Network
- HTTP/3 with QUIC: on.
- 0-RTT Connection Resumption: on.
- IPv6 Compatibility: on.
Security
- Security Level: Medium.
- Bot Fight Mode: on.
- Challenge Passage: 30 minutes.
- Browser Integrity Check: on.
Page Rules (3 free)
The free tier includes 3 page rules. Here are a few suggested uses for them.
Rule 1: Cache everything on static pages
For your homepage or specific static URLs:
- URL:
yourdomain.com/* - Cache Level: Cache Everything
- Edge Cache TTL: 2 hours
Be careful here, since this can end up caching logged-in pages if you’re not careful. It’s generally better to use APO for full-site caching instead, covered below.
Rule 2: Bypass cache on wp-admin
- URL:
yourdomain.com/wp-admin/* - Cache Level: Bypass
- Disable Performance
This keeps WordPress admin uncached, so you always see fresh changes immediately.
Rule 3: Bypass cache on preview links
- URL:
*preview=true* - Cache Level: Bypass
Cloudflare APO ($5/month)
APO, short for Automatic Platform Optimization, is Cloudflare’s WordPress-specific caching layer.
It caches dynamic pages too, not just static assets, with WordPress-aware purging that fires automatically when you publish or update a post.
What you actually get with it:
- Full-page caching at the edge.
- Smart purging tied to post updates.
- A significantly faster time-to-first-byte.
It runs $5 a month if you’re on the Free plan; it’s included automatically if you’re already on Cloudflare’s Pro plan or higher, according to Cloudflare’s own APO documentation. It’s often worth the cost for content-heavy blogs specifically.
You’ll want the official “Cloudflare” plugin installed on the WordPress side for the integration to work properly.
Image optimization (Polish + Mirage)
Cloudflare’s Pro tier, currently around $20 to $25 a month depending on billing, includes two image-focused features:
- Polish: automatic WebP/AVIF conversion of your images.
- Mirage: mobile-specific image optimization.
If you already run a dedicated image optimization plugin like Imagify or ShortPixel, you probably don’t need Polish on top of it.
If you don’t have one yet, Polish is a genuinely convenient alternative. For a deeper dive into the WordPress side of this, see our full image optimization guide.
WAF (Web Application Firewall)
The free tier includes basic WAF rules, which cover a reasonable baseline.
The Pro tier adds more rules, custom rule creation, and access to the OWASP rule set.
For most blogs, the free WAF combined with your host’s own WAF and a security plugin is genuinely enough. The Pro-tier WAF starts to matter more for sites facing serious, sustained threat exposure. Our WordPress security hardening checklist covers what to layer on top regardless of which WAF tier you’re on.
Cloudflare Workers (advanced)
This is Cloudflare’s serverless platform, letting you run code directly at edge locations.
Most bloggers won’t need this. It’s more relevant for advanced redirects, custom A/B testing, and geo-targeting setups.
Cloudflare Tunnel (advanced)
This lets you securely expose a local development site through Cloudflare without opening any firewall ports.
A fairly niche use case that most bloggers will rarely, if ever, need.
Analytics
Cloudflare Analytics shows you:
- Total requests.
- Bandwidth saved through cached responses.
- Threats blocked.
- Geographic traffic distribution.
- Browser and OS breakdown.
It complements GA4 well rather than replacing it. Cloudflare’s analytics run server-side, counting every visit including bots and cached responses, while GA4 is client-side and only counts a visit once JavaScript actually fires.
Common issues
“Too many redirects” error after setup
Usually caused by an SSL mode mismatch. Check that Cloudflare’s SSL/TLS setting is “Full (strict)” and that your host actually has a valid certificate installed.
White screen or 521 errors
This means Cloudflare can’t reach your origin server. Check your host’s status and confirm the A record points to the correct IP address.
Changes not appearing
The cache probably hasn’t purged yet. Go to Cloudflare → Caching → Purge Cache → Purge Everything.
WordPress admin running slow
Make sure wp-admin is excluded from caching using the page rule described above.
Login issues
Cookies occasionally get stripped in this setup. Make sure “Caching Level” isn’t set aggressively on your login URLs specifically.
WordPress plugin integration
Install the official Cloudflare plugin on the WordPress side.
Configure it with your Cloudflare API token, which enables:
- One-click cache purging directly from the WordPress admin.
- Automatic purging whenever you update a post.
- APO integration, if you’re using it.
Alternatively, plugins like WP Rocket integrate with Cloudflare too, so you’re not locked into a single approach.
Caching plugin interaction
You can run a caching plugin like WP Rocket or LiteSpeed alongside Cloudflare without conflict. They genuinely complement each other:
- WP Rocket and LiteSpeed optimize the WordPress side: database queries, asset minification, lazy loading.
- Cloudflare caches at the edge, globally, closer to each visitor.
Just avoid duplicating settings. Don’t enable minification in both places at once. Pick one layer to handle it.
Email considerations
When you move your DNS to Cloudflare, make sure your email DNS records, MX, SPF, DKIM, and DMARC, all carry over correctly.
If you’re using a host-provided email service, double-check that mail still delivers properly after the DNS switch, since this is a common thing to overlook.
What Cloudflare won’t do
- It doesn’t replace caching plugins entirely. You still want WordPress-side caching for the database query layer specifically.
- It doesn’t fix slow code. Poorly written plugins and themes still hurt your origin server’s response time.
- It doesn’t fix bad hosting. Your origin server still has to respond in a reasonable time.
- The free tier doesn’t include image optimization, since Polish requires Pro or above.
A genuinely fast foundation still starts with your theme and hosting, before Cloudflare even enters the picture. A lightweight theme like Aurora keeps your origin server’s response time low in the first place, which means Cloudflare’s caching has less work to do and your visitors benefit even on cache misses.
Cloudflare vs other CDNs
A few alternatives worth knowing about:
- BunnyCDN: starts around $1 a month, simple and fast.
- StackPath: positioned more toward enterprise CDN needs.
- KeyCDN: pay-per-GB pricing.
- AWS CloudFront: makes the most sense if you’re already inside the AWS ecosystem.
Cloudflare’s free tier, combining full DNS, WAF, CDN, and DDoS protection in one package, is genuinely hard to beat at this price point. Most of the alternatives above only handle the CDN piece on its own.
The setup that is actually worth it
Cloudflare’s free tier alone gives most blogs measurable gains in speed, security, and reliability. Set up your DNS, switch to full-strict SSL, configure basic caching, add the wp-admin bypass page rule, and turn on bot protection. Add APO at $5 a month for WordPress-aware full-page caching if you want more performance beyond that. Skip paying for Pro unless you specifically need its extras, like Polish or the advanced WAF rules. Cloudflare won’t fix bad code or bad hosting on its own, but it adds a genuinely strong protective and accelerating layer between your visitors and your site. If Cloudflare’s raised questions about your broader hosting setup, our managed vs shared hosting comparison is a good next read.
