A large share of the sites on the internet use Cloudflare. But what exactly does it do, and how useful is it for a small company's website? The short answer: speed, security and reliability — often on the free plan.
How does it work?
When your domain is connected to Cloudflare, visitors don't go straight to your server; they first reach Cloudflare's servers in cities around the world. Cloudflare checks the request, answers from its own cache where it can, and passes the request on to your server when needed. For the visitor, the site opens just as before — the difference is behind the scenes.
What do you gain?
- Speed. Images, style sheets and scripts are served from the server nearest the visitor, and the load on your server drops (see Core Web Vitals).
- Attack protection. Attempts to "flood" the site with masses of fake requests (DDoS) are filtered out before they reach your server; suspicious bots are sent to a check page.
- Free SSL. The connection between the visitor and Cloudflare is encrypted automatically, and the certificate renews automatically (why this matters).
- Hiding the server address. Attackers can't easily see your main server's IP address.
- Fast DNS. Your domain records are kept on one of the fastest DNS networks in the world, and changes take effect quickly.
- Statistics. You can see how many visits your site gets and how many threats were blocked.
What should you watch out for?
- The domain's NS records must point to Cloudflare — this usually takes effect within 24 hours;
- The SSL mode in Cloudflare should be Full (strict); "Flexible" mode turns off encryption on the server side and sometimes causes an endless redirect loop;
- Overly strict security settings can block real users or useful services (payment system notifications, search crawlers) — check the site after changing settings;
- In the caching settings, client account, cart and payment pages must be excluded from the cache — otherwise one user's data could be shown to another;
- Email records (MX) aren't "proxied" through Cloudflare — they must stay grey-clouded, direct.
Cloudflare isn't all of security
Cloudflare protects the site from some outside attacks, but doesn't fix internal problems like an old plugin, a weak password or missing backups. More: 7 steps to keep your website secure.
Frequently asked questions
Is it free? The core features — CDN, DDoS protection, SSL, DNS — are on the free plan. Extra security rules and image optimisation are on the paid plans.
Will my site go down? Not if it's connected properly. The records are copied over in advance, and the NS change takes effect while the site keeps running.
Our hosting clients' domains run on Cloudflare DNS with attack protection. If you'd like to connect your domain to Cloudflare or have your current settings checked, contact us from your client account.
Cloudflare protection is included as standard in all our hosting plans: hosting plans and prices.
