Cloudflare Setup Best Practices

Step 1: Add Your Domain

1. Sign up at cloudflare.com (Free plan is sufficient for most sites)
2. Click Add a Site and enter your domain
3. Cloudflare will scan existing DNS records — review and confirm

Step 2: Update Nameservers

Cloudflare provides two nameservers (e.g., ns1.cloudflare.com, ns2.cloudflare.com). Update these at your domain registrar so traffic flows through the Cloudflare CDN.

# Verify nameservers are updated (may take 1-48 hours)
dig +short ns example.com
# Should return: ns1.cloudflare.com  ns2.cloudflare.com

Step 3: Configure SSL/TLS

Recommended: Always use Full (Strict) with a valid origin certificate (e.g., from Let's Encrypt). Also enable Always Use HTTPS and configure HSTS with max-age=31536000 so browsers force HTTPS and downgrade attacks are blocked — confirm both together in the security settings in Step 6.

Step 4: Page Rules Configuration

Page Rules give you "global defaults plus path exceptions": most traffic follows the default cache policy while special paths (admin panels, dynamic scripts) get their own treatment. The Free plan allows only 3 rules, so decide which three path classes need differentiation first.

# Page Rules (Free plan: 3 rules)

Rule 1: example.com/wp-admin/*
  - Security Level: High
  - Cache Level: Bypass
  - Disable Apps: ✅

Rule 2: example.com/*.php
  - Cache Level: Standard
  - Edge Cache TTL: 0 (No cache for dynamic PHP)

Rule 3: example.com/wp-content/uploads/*
  - Cache Level: Standard
  - Edge Cache TTL: 7 days

Step 5: Performance Optimization

Enable in Dashboard

• ✅ Auto Minify — Minify HTML, CSS, JS automatically
• ✅ Brotli — Better compression than Gzip
• ✅ HTTP/2 & HTTP/3 — Faster connections
• ✅ 0-RTT Connection Resumption — Faster for returning visitors

Cache Configuration

# Browser Cache TTL: 4 hours (default)
# Edge Cache TTL: Depends on Page Rules

# Recommended Cache Rules:
- Static assets (js, css, png, jpg, webp): 30+ days
- HTML pages: 0-1 hour
- Admin panels: Bypass cache entirely

Cache TTL is ultimately a trade-off between freshness and hit ratio. Push static-asset TTL to 30+ days because those files are usually versioned in the name or path — updating a file means changing the name, which forces a refresh. HTML cached too long means users miss content updates, so 0-1 hour is the safer choice.

Step 6: Security Configuration

WAF (Web Application Firewall)

Security Level: Medium (default)
Challenge Passage: 30 minutes

Enabled Rules:
- SQL Injection Prevention (paired with web security hardening)
- XSS (Cross-site Scripting) Protection
- PHP Injection Prevention
- Directory Traversal Prevention
- Spam Protection

Additional Security Settings

• Bot Fight Mode — On (intercepts malicious bots)
• Rate Limiting — Protect login/API endpoints
• SSL — Full (Strict)
• Always Use HTTPS — On
• HSTS — Enable with max-age=31536000

Step 7: Verify Setup

# Check DNS propagation
dig +short example.com

# Check SSL certificate
curl -vI https://example.com 2>&1 | grep -i "ssl\|certificate"

# Check Cloudflare headers
curl -sI https://example.com | grep -i "cf-"

# Check HTTP/2 support
curl -sI --http2 https://example.com | head -5

Quick Checklist

• Domain added to Cloudflare
• Nameservers updated at registrar
• SSL set to Full (Strict)
• Auto Minify enabled
• Page rules configured for caching
• WAF security rules enabled
• Always Use HTTPS enabled
• HSTS configured
• DNS propagation verified

What to Prepare Before You Start

Three things make the whole process much smoother. First, domain management access: changing nameservers happens at the registrar, so make sure you know the registrar credentials before you start. Second, origin information: export your origin IP and current DNS records to a list and check them one by one during Cloudflare's scan, so you do not migrate test-environment records by accident. Third, an HTTPS certificate: if the origin already has a Let's Encrypt certificate, choose Full (Strict) directly; if not, install a certificate on the origin first instead of relying on Flexible — Flexible encrypts browser-to-Cloudflare but leaves Cloudflare-to-origin in plaintext.

Frequently Asked Questions

My domain stays "pending" after changing nameservers — what now? DNS changes typically take from a few minutes to 48 hours. First confirm locally that resolution now points at Cloudflare's nameservers, then check the registrar for leftover nameserver records. If it is still pending after 24 hours, contact the registrar to rule out caching or a lock period.

Is my origin IP exposed? By default, yes. Once the origin IP is known (e.g. through historical DNS records or email headers), attackers can bypass the CDN and hit the origin directly. Recommended: restrict the origin firewall to Cloudflare's IP ranges and enable the "only use Cloudflare certificates" style settings.

I enabled caching but the site is not faster? Check the hit ratio first. Use curl -sI and inspect the cf-cache-status header; if it keeps returning DYNAMIC, the page rule does not cover that path or the response carries a no-cache marker. Give static assets a long TTL and do not cache HTML for long.

What is the difference between Page Rules and Cache Rules? Page Rules are limited to 3 on the Free plan and suit simple "global plus exceptions" control; Cache Rules allow more rules with finer match conditions, which fits complex sites. New sites should build the basic framework with Page Rules and migrate to Cache Rules when they run out.