Cloudflare sits between your visitors and your web server, providing DNS, security and caching from a global network. A careful Cloudflare setup can make a site faster and more resilient, while a rushed one can cause redirect loops, broken email or certificate errors. This guide walks through the essentials in order, so you can switch on the benefits without the headaches.
Key takeaways
- Cloudflare works by becoming your authoritative DNS provider and, for proxied records, routing traffic through its network.
- Review imported DNS records carefully before changing nameservers, especially mail records.
- Use Full (strict) SSL mode with a valid certificate on your origin server to avoid insecure connections and redirect loops.
- Start with sensible caching and security defaults, then tune them rather than enabling every feature at once.
- Keep your origin server’s IP address private and restrict direct access where possible.
How Cloudflare works in simple terms
When someone types your domain into a browser, DNS translates the name into an IP address. Once Cloudflare manages your DNS, it can answer those lookups with the address of its own network instead of your server’s. Visitors connect to a nearby Cloudflare data centre, which serves cached content directly or forwards the request to your origin server.
This arrangement delivers three core benefits:
- Performance: static files such as images, CSS and JavaScript are cached closer to visitors.
- Security: Cloudflare absorbs many attacks, filters malicious traffic and hides your origin IP address.
- Reliability: its anycast network spreads load and can keep cached pages available during short origin outages.
Cloudflare offers a free plan with many core features and paid plans with more advanced controls. Features and plan inclusions change over time, so check the current plan details for your needs.
Step 1: Add your site and review DNS records
- Create a Cloudflare account and choose the option to add a site or domain.
- Enter your root domain, for example example.com, and select a plan.
- Cloudflare scans your existing DNS and imports the records it finds.
- Compare the imported list against your current DNS provider line by line. Scans can miss records, especially subdomains that are not commonly named.
Proxied vs DNS-only records
Each record has a proxy status, shown as an orange cloud (proxied) or a grey cloud (DNS only).
| Record type | Typical setting | Why |
|---|---|---|
| A / AAAA for website and www | Proxied | Enables caching, security and origin IP hiding |
| MX (mail) | DNS only (cannot be proxied) | Mail must reach your mail server directly |
| Mail server hostnames (e.g. mail.example.com) | DNS only | Cloudflare’s standard proxy handles web traffic, not email protocols |
| TXT (SPF, DKIM, DMARC, verification) | Not applicable | Text records are simply published |
| Subdomains for FTP, SSH or other non-web services | DNS only | Non-HTTP traffic generally needs a direct connection |
Pay particular attention to email. Missing MX, SPF, DKIM or DMARC records are the most common cause of problems after a move.
Step 2: Change your nameservers
Cloudflare assigns two nameservers to your account. Log in to your domain registrar, find the nameserver settings for the domain and replace the existing entries with the Cloudflare ones.
- If DNSSEC is enabled at your registrar, turn it off before changing nameservers, then re-enable it through Cloudflare once the domain is active.
- Changes can take anywhere from minutes to a day or more to propagate.
- Cloudflare emails you and shows the site as active once it detects the change.
For some country-code domains, such as .ae, the process runs through an accredited registrar, so allow extra time if your registrar needs to process the change manually.
Step 3: Configure SSL/TLS correctly
Encryption settings are where many Cloudflare setup problems begin. There are two connections to secure: visitor to Cloudflare, and Cloudflare to your origin server.
Understanding the encryption modes
- Off: no encryption. Do not use this for a live site.
- Flexible: encrypts visitor to Cloudflare only. The link to your server is unencrypted, and it often causes redirect loops on sites that already force HTTPS.
- Full: encrypts both connections but does not validate the origin certificate.
- Full (strict): encrypts both connections and requires a valid certificate on the origin. This is the recommended setting.
To use Full (strict), install a trusted certificate on your server, such as a free Let’s Encrypt certificate from your host, or a Cloudflare Origin CA certificate, which is trusted by Cloudflare but not by browsers directly.
Other SSL settings to enable
- Always Use HTTPS to redirect HTTP requests to HTTPS.
- Automatic HTTPS Rewrites to help fix mixed content warnings.
- HSTS only once you are confident HTTPS works everywhere, because browsers will refuse insecure connections for the period you set.
Step 4: Set up caching and performance basics
By default Cloudflare caches common static file types but not HTML pages. That is a safe starting point. From there:
- Keep the caching level at standard and set a sensible browser cache expiry.
- Enable Brotli compression if it is not already on.
- Use cache rules to bypass caching for admin areas, carts, checkouts and logged-in sessions.
- Consider caching HTML for mostly static pages only if you understand how purging works on your platform.
- Purge the cache after major design or content changes, or install your CMS’s Cloudflare plugin to automate this.
For WordPress sites, avoid stacking conflicting optimisations. If your caching plugin already minifies and combines files, do not duplicate the work elsewhere, and test pages after each change.
Step 5: Apply essential security settings
- Turn on the managed web application firewall rules available on your plan.
- Create a rule to challenge or block access to login pages, such as wp-login.php, from countries or networks you never expect to use them.
- Use rate limiting on login and form endpoints if your plan supports it.
- Enable bot protection features appropriate for your site, and check they do not block legitimate services such as payment callbacks.
- Protect your Cloudflare account with two-factor authentication and limit who has access.
Protect your origin
Proxying hides your server’s IP, but old DNS records or email headers can still reveal it. Where your host allows, configure the firewall to accept web traffic only from Cloudflare’s published IP ranges, and consider rotating the origin IP if it was previously public.
Common Cloudflare setup mistakes to avoid
- Using Flexible SSL on a site that forces HTTPS, causing “too many redirects” errors.
- Proxying mail or FTP subdomains, which breaks those services.
- Forgetting to copy verification TXT records for tools such as Google Search Console.
- Caching pages that contain personal data or cart contents.
- Enabling HSTS with a long duration before testing every subdomain.
Frequently asked questions
Is Cloudflare’s free plan enough for a small business?
For many small sites, yes. The free plan covers DNS, a global CDN, universal SSL and basic protection. Paid plans add advanced firewall controls, more rules and better support.
Will moving to Cloudflare cause downtime?
Not if you copy every DNS record accurately before changing nameservers. Both old and new DNS will return the same answers during propagation.
Why am I seeing too many redirects after enabling Cloudflare?
This is usually caused by Flexible SSL combined with a server that forces HTTPS. Install a certificate on your origin and switch to Full (strict).
Do I still need a security plugin on WordPress?
Cloudflare adds a strong outer layer, but keeping WordPress, themes and plugins updated and using sound login security still matter.
Final thoughts
A good Cloudflare setup is methodical: verify DNS, change nameservers, secure both connections with Full (strict), then add caching and security rules one step at a time. Test after each change and document what you configure. With the basics in place, your site will be faster, safer and easier to manage.