Why Cloudflare?
Cloudflare sits between your visitors and your web server, acting as a reverse proxy that provides CDN caching, DDoS protection, SSL, and performance optimization. It's used by over 20% of all websites — and for good reason.
Benefits include:
- CDN: 300+ edge locations worldwide for fast content delivery
- DDoS Protection: Enterprise-grade protection on all plans
- Free SSL: Universal SSL with one click
- Web Application Firewall (WAF): Block malicious traffic
- Performance: Auto minification, Brotli compression, image optimization
Step 1: Add Your Site to Cloudflare
- Create a Cloudflare account at cloudflare.com
- Add your domain and let Cloudflare scan your existing DNS records
- Review the imported DNS records — ensure all critical records (A, CNAME, MX, TXT) are present
- Change your domain's nameservers at your registrar to Cloudflare's assigned nameservers
- Wait for propagation (typically 5-30 minutes, up to 24 hours)
Step 2: Configure SSL/TLS
- Set SSL/TLS mode to Full (Strict) — this ensures end-to-end encryption
- Enable "Always Use HTTPS" to redirect HTTP to HTTPS
- Enable HSTS (HTTP Strict Transport Security) with a 6-month max-age
- Set Minimum TLS Version to 1.2
- Enable Automatic HTTPS Rewrites to fix mixed content
Step 3: Optimize Performance Settings
- Auto Minify: Enable for HTML, CSS, and JavaScript
- Brotli Compression: Enable for better compression than Gzip
- HTTP/3: Enable for faster connections with QUIC protocol
- Early Hints: Enable to send preload hints before the full response
- Rocket Loader: Enable to defer all JavaScript loading (test thoroughly!)
Step 4: Set Up Caching Rules
Cloudflare's default caching only covers static assets (images, CSS, JS). For full-page caching, you need cache rules:
- Static Pages: Cache Everything with Edge Cache TTL of 2 hours
- Dynamic Pages: Bypass cache for /wp-admin/, /cart/, /checkout/, /my-account/
- API Endpoints: Bypass cache for /api/ and /wp-json/ paths
- Browser Cache TTL: Set to "Respect Existing Headers" for granular control
Step 5: Security Configuration
- Enable Bot Fight Mode to block known malicious bots
- Set Security Level to "Medium" (adjust based on attack frequency)
- Configure rate limiting for login pages and API endpoints
- Block known bad countries if not serving those markets
- Enable Under Attack Mode only during active DDoS attacks
Step 6: Image Optimization (Pro Plan)
- Polish: Automatically compress images (Lossy or Lossless)
- WebP: Serve WebP to supported browsers automatically
- Mirage: Lazy load images and serve optimized versions on slow connections
Results
A properly configured Cloudflare setup typically delivers:
- 40-60% reduction in bandwidth usage
- 50-70% improvement in TTFB for cached pages
- 99.99% uptime even during traffic spikes
- Zero downtime from DDoS attacks
Need help setting up Cloudflare for your website? Get in touch for a professional setup.