Quick answer: Cloudflare sits between your visitors and your WordPress server, caching static files on servers around the world, filtering bad traffic and offering free SSL. To set it up, add your site to Cloudflare, check the imported DNS records, switch your domain’s nameservers, and choose an SSL mode (Full or Full Strict if your server has a certificate). Then add page rules to bypass the cache for /wp-admin/ and the login page, turn on minification carefully, and install a plugin or server module so WordPress sees visitors’ real IP addresses. Test logged in pages, forms and checkout after each change.
Cloudflare’s free plan is one of the most popular add-ons for WordPress sites, and for good reason. It costs nothing, takes less than an hour to set up and can reduce load on your server noticeably. But it also changes how traffic reaches your site, and some settings that sound helpful can cause problems with a dynamic CMS. Here is how to get the benefits without the headaches.
What Cloudflare does
When you use Cloudflare, your domain’s DNS points at Cloudflare’s network instead of directly at your server. Visitors connect to the nearest Cloudflare data centre, which:
- Serves cached static files such as images, CSS and JavaScript directly, without touching your server.
- Passes other requests through to your server and returns the response.
- Filters traffic, blocking known bad bots and some attacks before they reach you.
- Handles SSL, so visitors get HTTPS even if your own server setup is basic.
It also supports HTTP/2 for visitors on modern browsers, which speeds up pages that load many files.
Before you start
- Take a backup of your site.
- Note your current DNS records, especially email (MX) records.
- Make sure you can log in to your domain registrar to change nameservers.
- If your site is already on HTTPS, note where the certificate comes from.
Step 1: Add your site and check DNS
Sign up, add your domain, and Cloudflare scans your existing DNS records. Check them carefully against your notes. Missing records, especially MX records for email or subdomains used by other services, are the most common cause of problems after switching.
Each record has a cloud icon:
- Orange cloud: traffic goes through Cloudflare. Use this for your main site (
yoursite.comandwww). - Grey cloud: DNS only, traffic goes directly to the server. Use this for mail servers, FTP, cPanel and anything else that should not be proxied.
Step 2: Change nameservers
Cloudflare gives you two nameservers. Replace the existing ones at your domain registrar. The change can take from a few minutes to a day to take effect. Your site stays online throughout, because both old and new DNS point at the same server.
Step 3: Choose the right SSL mode
This is where most WordPress problems start. Cloudflare offers several modes:
- Off: no HTTPS.
- Flexible: HTTPS between the visitor and Cloudflare, plain HTTP between Cloudflare and your server.
- Full: HTTPS on both legs, but Cloudflare does not check your server’s certificate, so a self signed one works.
- Full (Strict): HTTPS on both legs with a valid certificate on your server.
Free plans include Universal SSL, so visitors get a certificate from Cloudflare automatically.
Why Flexible causes problems
With Flexible, your server receives plain HTTP requests. If WordPress is set to use HTTPS, or a plugin forces HTTPS, it redirects the request to HTTPS. Cloudflare passes it back as HTTP, WordPress redirects again, and the visitor sees a redirect loop. Flexible can be made to work with extra configuration, but it also leaves the connection to your server unencrypted.
Our advice: put a certificate on your server (free from Let’s Encrypt) and use Full (Strict).
Finishing the move to HTTPS
Once SSL works, update the WordPress Address and Site Address to HTTPS under Settings, General, redirect all HTTP traffic to HTTPS (with a Cloudflare page rule or at your server), and fix mixed content by updating old HTTP links in your content.
Step 4: Caching settings
By default, Cloudflare caches static files based on their extension and does not cache HTML pages. That is a safe default for WordPress.
Caching level and browser expiry
- Caching level: Standard is fine for most sites.
- Browser cache expiration: a value of a few hours to a day works for most. If your server already sets good cache headers, you can let it respect those.
Page rules to protect dynamic areas
The free plan includes three page rules. Use them wisely:
yoursite.com/wp-admin*: Cache Level Bypass, Disable Performance. This keeps the dashboard working normally and stops speed features interfering with it.yoursite.com/wp-login.php*: Security Level High. Adds extra checks for anyone reaching the login page.- A rule for whatever else your site needs, such as forcing HTTPS or bypassing the cache for a shop’s basket and checkout.
Caching HTML pages
A “Cache Everything” page rule makes Cloudflare cache whole pages, which can greatly reduce server load. But WordPress pages change when you publish, and logged in users and shoppers need personal content. Cache Everything on a WordPress site needs careful exceptions and cache purging when content changes. For most sites, a WordPress caching plugin on the server is safer, with Cloudflare handling static files.
Step 5: Speed settings
- Auto Minify: removes whitespace from HTML, CSS and JavaScript. Usually safe, but test, because minified JavaScript occasionally breaks. If you already minify with a plugin, you do not need both.
- Rocket Loader: changes how JavaScript loads to speed up rendering. It can break sliders, forms and other scripts. Test thoroughly or leave it off.
- Always Online: shows a cached copy of pages if your server goes down. Useful as a safety net.
Paid plans add image optimisation and a web application firewall, which may be worth it for busy or high risk sites.
Step 6: Restore visitor IP addresses
Because traffic passes through Cloudflare, your server sees Cloudflare’s IP addresses instead of visitors’. That affects comment spam filtering, security plugins, login limiters and server logs.
Fix it with:
- mod_cloudflare for Apache, or the real IP module for Nginx, configured with Cloudflare’s IP ranges.
- The Cloudflare WordPress plugin, which also restores IPs at the WordPress level and adds some convenient settings.
Security plugins that block IPs after failed logins need this to work properly, otherwise they may block Cloudflare itself. Our WordPress security guide covers login protection.
Step 7: Security settings
- Security level: Medium suits most sites. Raise it temporarily if you are under attack.
- Browser Integrity Check: blocks requests with suspicious headers, common among spam bots.
- Under Attack mode: shows a short check page to all visitors during a serious attack. Turn it off when the attack ends.
Purging the cache
When you change CSS or JavaScript and do not see the change, Cloudflare may still be serving the old file. Purge individual files or the whole cache from the dashboard, or turn on Development Mode, which bypasses the cache for three hours while you work. Adding a version number to file URLs avoids most of these issues.
Testing checklist
After setup, check:
- The homepage and several inner pages over HTTPS.
- Logging in and using the dashboard.
- Contact forms and comments.
- The basket and checkout, if you run a shop.
- Email still arrives (MX records intact).
- Your security plugin shows real visitor IPs.
FAQ
Will Cloudflare make my WordPress site faster?
Usually, especially for visitors far from your server and for pages with many images and scripts. It does not fix slow page generation on the server; for that, see caching and hosting.
Is the free plan enough?
For most small and medium sites, yes. Paid plans add image optimisation, a firewall and more page rules.
Can Cloudflare break my site?
Wrong SSL settings and over aggressive speed features are the usual causes. Change one setting at a time and test.
A faster, safer front door for your site
Set up properly, Cloudflare takes load off your server and blocks a good share of unwanted traffic. We configure it alongside server caching and security so each layer does its own job. See how we help businesses turn visitors into customers with fast, reliable sites.
