Step 1: Add Your Domain

  1. Sign up at cloudflare.com (Free plan is sufficient for most sites)
  2. Click Add a Site and enter your domain
  3. Cloudflare will scan existing DNS records — review and confirm

Step 2: Update Nameservers

Cloudflare provides two nameservers (e.g., ns1.cloudflare.com, ns2.cloudflare.com). Update these at your domain registrar.

# Verify nameservers are updated (may take 1-48 hours)
dig +short ns example.com
# Should return: ns1.cloudflare.com  ns2.cloudflare.com

Step 3: Configure SSL/TLS

Mode Encryption Trust Level Best For
Off None — Testing only
Flexible Browser↔Cloudflare only Low No SSL on origin
Full End-to-end Medium Origin has self-signed cert
Full (Strict) End-to-end with validation High Recommended

Recommended: Always use Full (Strict) with a valid origin certificate (e.g., from Let's Encrypt).

Step 4: Page Rules Configuration

# Page Rules (Free plan: 3 rules)

Rule 1: example.com/wp-admin/*
  - Security Level: High
  - Cache Level: Bypass
  - Disable Apps: ✅

Rule 2: example.com/*.php
  - Cache Level: Standard
  - Edge Cache TTL: 0 (No cache for dynamic PHP)

Rule 3: example.com/wp-content/uploads/*
  - Cache Level: Standard
  - Edge Cache TTL: 7 days

Step 5: Performance Optimization

Enable in Dashboard

  • ✅ Auto Minify — Minify HTML, CSS, JS automatically
  • ✅ Brotli — Better compression than Gzip
  • ✅ HTTP/2 & HTTP/3 — Faster connections
  • ✅ 0-RTT Connection Resumption — Faster for returning visitors

Cache Configuration

# Browser Cache TTL: 4 hours (default)
# Edge Cache TTL: Depends on Page Rules

# Recommended Cache Rules:
- Static assets (js, css, png, jpg, webp): 30+ days
- HTML pages: 0-1 hour
- Admin panels: Bypass cache entirely

Step 6: Security Configuration

WAF (Web Application Firewall)

Security Level: Medium (default)
Challenge Passage: 30 minutes

Enabled Rules:
- SQL Injection Prevention
- XSS (Cross-site Scripting) Protection
- PHP Injection Prevention
- Directory Traversal Prevention
- Spam Protection

Additional Security Settings

  • Bot Fight Mode — On (intercepts malicious bots)
  • Rate Limiting — Protect login/API endpoints
  • SSL — Full (Strict)
  • Always Use HTTPS — On
  • HSTS — Enable with max-age=31536000

Step 7: Verify Setup

# Check DNS propagation
dig +short example.com

# Check SSL certificate
curl -vI https://example.com 2>&1 | grep -i "ssl\|certificate"

# Check Cloudflare headers
curl -sI https://example.com | grep -i "cf-"

# Check HTTP/2 support
curl -sI --http2 https://example.com | head -5

Quick Checklist

  • Domain added to Cloudflare
  • Nameservers updated at registrar
  • SSL set to Full (Strict)
  • Auto Minify enabled
  • Page rules configured for caching
  • WAF security rules enabled
  • Always Use HTTPS enabled
  • HSTS configured
  • DNS propagation verified