Cloudflare Free gives you CDN, WAF, SSL and DDoS protection at no cost. Most sites see a real improvement in both speed and security.
Connecting the domain
- Sign up at cloudflare.com
- Add a Site → enter your domain
- Cloudflare scans the existing DNS records
- Change the nameservers at your registrar to the Cloudflare ones
SSL configuration
SSL/TLS → Full (Strict), assuming you already have a certificate on the server. Never use Flexible — it sends traffic over plain HTTP between Cloudflare and your server.
Page rules (3 free)
*yourdomain.com/wp-admin/* → Cache Level: Bypass *yourdomain.com/cart* → Cache Level: Bypass *yourdomain.com/*.jpg → Cache Level: Cache Everything, Edge Cache TTL: 1 month
Cache rules (the newer mechanism)
Caching → Cache Rules → Create rule. More flexible than page rules, with up to 5 on the free plan.
Security recommendations
- Security → WAF → Managed Rules: enable the Cloudflare managed ruleset
- Bot Fight Mode: enable it (block AI bots, allow verified ones)
- Rate limiting: cap /wp-login.php and /admin/ at around 10 requests per minute
Speed settings
- Polish: lossless or lossy (WebP conversion)
- Rocket Loader: use with care — it can break inline JS
- Minify: HTML, CSS, JS
Want this configured for you? Cloudflare setup, done properly.
