Edge & Infrastructure
Cloudflare Setup & CDN Engineering
Cloudflare configured the way it should be: aggressive edge caching that does not break dynamic content, WAF rules calibrated to your real traffic, and Workers used where they actually save a request. Not the default checklist — a tuned production setup.
What's Included
Comprehensive solutions tailored to your specific needs
Cache Rules & Tiered Cache
HTML caching where safe, per-content-type TTLs, and origin shielding to push hit rate above 90 percent.
WAF calibration
Managed and custom rules tuned against your real traffic in monitor mode before enforcement.
SSL/TLS hardening
Full (Strict), Origin Certificate, HSTS with preload eligibility, and TLS 1.3 only.
Workers engineering
Edge personalisation, A/B testing, request shaping, and graceful origin degradation where they pay off.
Bot, rate limit & Page Shield
Turnstile, Bot Management, login rate limits, and client-side script monitoring.
Configuration as code
Terraform or wrangler exports so your team owns the config, with a runbook for common failure modes.
Problems I Solve
Symptoms this engagement is built to fix
Cloudflare enabled but a sub-5 percent cache hit rate because nothing has been configured to cache.
WAF set to a default Managed Ruleset that is blocking legitimate users and missing the actual bot threats.
SSL set to Flexible — exposing the origin and breaking secure cookies — instead of Full (Strict).
Origin still being hit on every request because Page Rules were never written for the real URL patterns.
DDoS or scraping incidents handled reactively in the dashboard instead of via Workers and rate limiting.
A dev team that wants to use Workers but does not know which problems they should actually solve.
Why default Cloudflare leaves most of the value on the table
Cloudflare's free plan is the best free product on the internet, but turning it on and walking away gets you maybe 20 percent of what it can do. The default configuration assumes the worst about your stack: no HTML caching, conservative WAF rules, Flexible SSL, and no Page Rules. That keeps you safe from breaking your site on day one, and it also keeps your origin under load, your security posture weak, and your performance gains modest. A tuned Cloudflare configuration caches the HTML where the CMS allows, uses Cache Rules and Tiered Cache to push hit rate above 90 percent, runs the WAF in monitor mode first to calibrate against real traffic, and uses Workers to handle the request shaping that would otherwise hit your origin.
What an engineered Cloudflare setup actually covers
Performance layer: Cache Rules tuned per content type, Tiered Cache for origin shielding, Argo Smart Routing where the maths works out, HTTP/3 and 0-RTT for repeat visitors, Brotli, Early Hints, image resizing for responsive delivery, and Polish for automatic format conversion. Security layer: WAF Managed Rulesets calibrated against your real traffic, custom rules for credential stuffing and scraping, Bot Management or Turnstile to replace third-party CAPTCHA, rate limiting on login and checkout, and Page Shield for client-side script monitoring. Reliability layer: Load Balancing across origins, Health Checks with automatic failover, and Workers for graceful degradation when the origin is offline. Edge logic: Workers for A/B tests, header rewrites, geo-personalisation, edge-side authentication, and request shaping that removes load from your origin.
The SSL mistake that breaks more sites than DDoS does
Most Cloudflare accounts I audit are configured with Flexible SSL, which encrypts the browser-to-Cloudflare leg of the connection but leaves Cloudflare-to-origin in plain HTTP. This is worse than no SSL at all because it lulls developers into thinking the connection is secure, breaks any cookie marked Secure, and on certain origins causes infinite redirect loops the moment HSTS lands in a browser. The correct setting is Full (Strict) with a valid certificate on the origin — ideally an Origin Certificate signed by Cloudflare for 15-year validity. This is a 10-minute fix that materially improves both security and uptime.
Where Cloudflare Workers earn their keep
Workers are not always the answer, but they earn their keep on a small number of high-leverage patterns. Edge-side personalisation: serve a logged-out cached page with a personalised banner injected at the edge based on a cookie, so you keep cache hit rate near 100 percent without losing relevance. Header manipulation: add security headers, fix Vary chaos, or normalise URL parameters so caching actually works. A/B testing: assign and remember variants at the edge without shipping a heavy client-side experimentation library. Edge authentication: protect staging sites or paywalled content without involving the origin. Origin shield: rewrite, retry, or gracefully degrade when the origin is slow or down. I use Workers where they save real cost or latency and avoid them where a Page Rule will do.
How the engagement protects you from the bad changes too
Cloudflare's dashboard is powerful enough to take down a production site in one click — wrong SSL mode, broken Page Rule, an aggressive WAF rule that blocks Stripe webhooks. Every change in this engagement is documented, deployed in monitor mode first where applicable, and rollback-tested. You receive a configuration-as-code export (Terraform or wrangler config, depending on your team's preference), a runbook for the common failure modes, and a 30-day support window for any post-launch surprises. If your team wants ongoing oversight, the monthly retainer covers ruleset updates, quarterly WAF calibration, and Workers feature work.
What You Receive
Deliverables & expected outcomes
- Audited and re-engineered Cloudflare zone configuration
- WAF calibrated against your real traffic with custom rules
- Workers for the high-leverage patterns I identify
- Configuration-as-code export (Terraform or wrangler)
- Operations runbook for common Cloudflare incidents
- 30-day post-launch support window
Illustrative Engagement
A representative scenario
The problem
A high-traffic media site was on Cloudflare Pro but seeing a 12 percent cache hit rate, origin overloaded during traffic spikes, and a WAF blocking 0.3 percent of legitimate paying subscribers.
The approach
We wrote Cache Rules tuned per content type, enabled Tiered Cache and Argo, ran the WAF in monitor mode for ten days to calibrate, and deployed a Worker that injected personalisation into cached HTML based on a subscriber cookie.
The outcome
Cache hit rate rose to 94 percent, origin egress fell by 71 percent, false-positive WAF blocks dropped to near zero, and the site held cleanly through the next viral spike without scaling the origin.
Composite scenario based on typical engagements. Replace with a real, attributed case study once published.
My Process
A proven methodology for delivering exceptional results
Zone audit
Full review of current configuration, SSL mode, Page Rules, WAF rulesets, DNS, and cache hit rate.
Performance & security plan
Cache strategy, WAF calibration plan, and Workers proposal scoped to your actual traffic patterns.
Staged rollout
Changes deployed progressively with monitor mode where applicable, full rollback plan, and a maintenance window for high-risk items.
Handover
Configuration as code, runbook, and a 30-day support window covering any post-launch behaviour.
Why Choose Me?
With 7+ years of experience and a track record of delivering results, I bring expertise, reliability, and a results-driven approach to every project.
- Cache hit rate engineered into the 90 percent range, not the default 20
- WAF calibrated against your real traffic, not a generic ruleset
- Workers used surgically where they pay back the cost
- Configuration-as-code so your team owns it after I leave
- Honest pricing — most engagements work on free or Pro, not Enterprise
- Runbook and 30-day support so incidents do not catch you off guard
Starting at
€197
Zone audit, performance and security re-engineering, Workers where they pay off, configuration as code, and a 30-day support window.
Frequently Asked Questions
Related Services
Further Reading
Related articles from the blog
Ready to Get Started?
Let's discuss your project and create a custom strategy for success.