Key takeaways
- Cloudflare adds DNS, CDN, SSL, firewall and DDoS protection in front of your WordPress site — much of it free.
- Use SSL mode “Full (strict)”, cache static assets, and bypass cache for admin, cart and logged-in users.
- Test after each change; verify Googlebot isn’t blocked and purge the cache after updates.
Cloudflare sits between your visitors and your server, speeding up delivery and filtering attacks. For most WordPress sites it’s one of the highest-value free upgrades. Here’s a safe setup.
Step 1: add your site#
- Create a Cloudflare account and add your domain.
- Review imported DNS records carefully — especially A, CNAME, MX and TXT. Missing records break email or subdomains.
- Choose which records are proxied (orange cloud) — your website’s A/CNAME records. Email (MX) and some service records must be DNS only (grey cloud).
- Change your domain’s nameservers at the registrar to the two Cloudflare provides. Activation can take a few hours.
Background: DNS explained.
Step 2: SSL/TLS#
- SSL/TLS → Overview → Full (strict) (requires a valid certificate on your server — your host’s Let’s Encrypt or a Cloudflare Origin Certificate).
- Never use “Flexible” with WordPress — it causes redirect loops and leaves the server leg unencrypted.
- Edge Certificates → enable Always Use HTTPS and Automatic HTTPS Rewrites.
- Minimum TLS version 1.2; enable TLS 1.3.
Step 3: speed settings#
| Setting | Recommendation |
|---|---|
| Caching level | Standard |
| Browser cache TTL | Respect existing headers (or 1 month for static assets) |
| Brotli, HTTP/2, HTTP/3 | On |
| Early Hints | On |
| Rocket Loader | Test carefully — can break scripts; often better off |
| Auto Minify | Retired by Cloudflare; let your caching plugin handle minification |
Need a hand with this?
Get a quick, honest review of your website’s SEO.
Step 4: cache HTML safely (optional)#
Caching full HTML pages at the edge gives the biggest speed gains. Create a Cache Rule that caches everything except:
- URLs containing
/wp-admin,/wp-login.php,/wp-json,preview=true. - Cart, checkout and my-account pages.
- Requests with cookies like
wordpress_logged_in_,woocommerce_items_in_cart,wp_woocommerce_session_.
Alternatively, use Cloudflare APO for WordPress (paid add-on) or a caching plugin with Cloudflare integration that purges automatically when you publish.
Step 5: security#
- Security → WAF: enable managed rules (available on paid plans) or free managed ruleset.
- Bot Fight Mode: test — it can block legitimate tools; ensure verified bots (Googlebot) are allowed.
- Rate limiting or a WAF rule to protect
/wp-login.phpandxmlrpc.php. - Use Turnstile (Cloudflare’s privacy-friendly captcha) on login forms if needed.
Step 6: verify#
- Check response headers for
cf-cache-status: HITon static files (and HTML if cached). - Test logged-in admin, forms, cart and checkout.
- Run URL Inspection in Search Console to confirm Googlebot gets 200 responses.
- Compare PageSpeed Insights before and after.
More: what is a CDN, WordPress speed, WordPress security.
Cloudflare FAQ#
Will Cloudflare affect my email?#
Not if MX and related records are copied correctly and set to DNS only.
Why do I see old content after updating?#
The cache needs purging. Use your caching plugin’s Cloudflare integration or purge manually.
Does Cloudflare hide my server IP?#
Proxied records hide it from the public DNS, but other records (like mail) can still reveal it.