Cloudflare Free Plan: Getting the Most Out of It

Cloudflare Free gives you CDN, WAF, SSL and DDoS protection at no cost. Most sites see a real improvement in both speed and security.

Connecting the domain

1. Sign up at cloudflare.com
2. Add a Site → enter your domain
3. Cloudflare scans the existing DNS records
4. Change the nameservers at your registrar to the Cloudflare ones

SSL configuration

SSL/TLS → Full (Strict), assuming you already have a certificate on the server. Never use Flexible — it sends traffic over plain HTTP between Cloudflare and your server.

Page rules (3 free)

*yourdomain.com/wp-admin/*   → Cache Level: Bypass
*yourdomain.com/cart*         → Cache Level: Bypass
*yourdomain.com/*.jpg         → Cache Level: Cache Everything, Edge Cache TTL: 1 month

Cache rules (the newer mechanism)

Caching → Cache Rules → Create rule. More flexible than page rules, with up to 5 on the free plan.

Security recommendations

• Security → WAF → Managed Rules: enable the Cloudflare managed ruleset
• Bot Fight Mode: enable it (block AI bots, allow verified ones)
• Rate limiting: cap /wp-login.php and /admin/ at around 10 requests per minute

Speed settings

• Polish: lossless or lossy (WebP conversion)
• Rocket Loader: use with care — it can break inline JS
• Minify: HTML, CSS, JS

Want this configured for you? Cloudflare setup, done properly.