Cloudflare sits between your visitors and your site’s server. Picture the front desk of an office building: every visitor walks past it before going up. It keeps the documents people often ask for within reach, turns away unwanted guests and tells nobody which floor your office is on. Your site is still in the same place. Simply, nobody gets in without going through the front desk.
What Cloudflare actually does
First, Cloudflare becomes your domain’s address book, the DNS. It answers when a browser asks where yourcompany.ca is, and it also says where to deliver your email.
Next, it keeps copies of the files that rarely change (images, stylesheets, scripts, fonts) in its network, present in more than 340 cities, including Montreal and Toronto. A visitor in Quebec City or Gaspé gets those files from a nearby server, and your own server has less work to do. By default, the pages themselves (the HTML) aren’t cached: they always come from your server.
It protects, too. Cloudflare absorbs denial-of-service attacks, with no volume limit, on every plan. It filters out some malicious bots, and it hides your server’s real address. Finally, it provides a free HTTPS certificate, and Turnstile, its free form protection, which we compare with Google’s in our Turnstile vs reCAPTCHA article.
What the free plan covers
For a small business site, the free plan does the essentials: DNS, file copies across the network, HTTPS, denial-of-service protection and basic firewall rules. Paid plans add finer rules, better statistics and support.
One paid option is worth knowing about for WordPress: Automatic Platform Optimization (APO), at US$5 a month on the free plan. It caches the HTML pages themselves, except for logged-in visitors. APO requires the Cloudflare plugin for WordPress. If your server already caches its pages and your visitors are mostly in Quebec, it adds little: we skip it. It makes sense when the hosting offers no page cache, when visitors come from all over the world, or to absorb traffic spikes.
What Cloudflare doesn’t fix
Cloudflare doesn’t make a slow site fast. If your server takes three seconds to build a page, it still does, since pages aren’t cached by default. A page heavy with scripts stays heavy. The problem gets fixed in the theme and on the server. Cloudflare is one more layer in front of a healthy site, not a bandage for a sick one.
It doesn’t replace updates either. A vulnerability in a WordPress plugin is often exploited with requests that look like normal traffic. The firewall stops some of them. Not all.
The most common pitfalls
Cloudflare takes a few clicks to set up. That’s also what makes it easy to set up wrong. Here are the most common configuration mistakes:
- “Flexible” encryption. It encrypts the connection between the visitor and Cloudflare, but not the one between Cloudflare and your server. If the server already redirects to HTTPS, the site loops and becomes unreachable. Cloudflare itself recommends the “Full” or “Full (strict)” modes.
- Automatic optimizations turned on without testing. Rocket Loader, for example, changes the order in which scripts load, and a menu or a form can stop working. Cloudflare advises turning it off at the first sign of a JavaScript problem.
- A rule that caches every page, with no exceptions. A visitor’s cart, the account page or a form can then show stale data.
- Records forgotten when moving the domain to Cloudflare. One missing email record is enough for messages to stop arriving.
- An account in the name of a former agency or a former employee. The day a setting needs changing, or simply the server’s address, nobody has the keys.
That last pitfall is the most common, and the easiest to avoid. The Cloudflare account must be in your name. Your provider is invited as a member, with the permissions it needs, and leaves the day you change providers. Our hosting checker also tells you whether your site is behind Cloudflare: it flags it instead of showing the host.
Setting up Cloudflare, in order
If you do it yourself, the order matters more than the settings.
First, create the account in the company’s name, with an email address that won’t leave with an employee, and turn on two-factor authentication. Then add the domain. Cloudflare imports the DNS records it finds, but not necessarily all of them: compare them one by one with your current provider’s, especially the email records. If DNSSEC is enabled at your registrar, turn it off before changing anything, or the domain can become unreachable.
Then comes the switch: at your registrar, you replace the name servers with the two Cloudflare gives you. Cloudflare warns that the update can take up to 24 hours. Do it early in the week, not on a Friday evening.
Once the domain is active, set encryption to “Full (strict)”, force HTTPS, then test the site as is. Optimizations come next, one at a time, with a test of the forms, menus and cart after each one. Finally, invite your provider as an account member rather than giving them your password.
Should you put Cloudflare in front of your site?
For most small business WordPress sites, yes: the free plan brings protection and speed you would otherwise pay a lot for. On two conditions. Someone who knows what they are doing sets it up and checks the site after every setting. And if your IT team already manages the domain and email, it is in the loop before any DNS change.
When we optimize a site’s speed, we suggest Cloudflare once the fixes at the source are done, and only if your IT team agrees.
