Your site is slow for visitors outside the country where the server sits, or a wave of fake traffic took it down for hours, and someone told you to "turn on Cloudflare." In many cases that is good advice. Switching it on quickly without understanding what changes can also break your email, or trap the site in an endless redirect loop.
What is a content delivery network (CDN)?
A CDN is a set of servers spread across many cities. They keep copies of your site's static files, such as images, CSS and JavaScript, and serve them to each visitor from the nearest location. Your origin server stays where it is and receives fewer requests.
The effect is most visible when your audience is spread across countries, or when the server is far from your visitors. Someone in Riyadh visiting a site hosted in Europe gets the images from a closer point, so the page opens faster.
How does Cloudflare work with your website?
In the usual setup you move your domain's DNS to Cloudflare by changing the nameservers at your registrar. Then for each record you choose whether it goes through Cloudflare (the orange cloud, meaning proxied) or points straight at your server (DNS only).
- VisitorRequests a page from your site
- CloudflareInspects the request and answers with cached files if it has them
- Your serverOnly receives what is not cached and requests that passed inspection
- ResponseGoes back to the visitor through Cloudflare
When the site is proxied, people see Cloudflare's addresses instead of your server's, and that is a big part of the protection.
Cloudflare also issues an SSL certificate for visitors automatically on proxied domains, but the connection between Cloudflare and your server needs its own certificate on the server. Nameserver changes go through the registry for your extension, so they can take hours to reach everyone. Plan the switch for a quiet time, the same way you would when moving the site to a new host.
Will Cloudflare make my site faster?
It usually speeds up static files, especially for visitors far from the server. It does not cache the HTML pages themselves by default, so their speed still depends on the server and on how the site is built.
If the slowness comes from huge images, too many plugins or heavy database queries, Cloudflare alone won't fix it. Start with the causes we cover in why your website is slow on mobile, then add Cloudflare on top of a site that is already in good shape.
How does Cloudflare protect your site from attacks?
It sits between the internet and your server, absorbs DDoS attacks that try to flood the site with requests, and hides the server's real address. The free plan includes protection against these attacks, and paid plans add broader web application firewall (WAF) rules.
You can also set simple rules yourself, such as an extra challenge for anyone opening the login page, or limiting the admin panel to certain countries or addresses. These rules cut down password guessing attempts. You still need to keep the site updated and use strong passwords. If your site has been hacked before, the steps are in your website was hacked: what to do in the first 24 hours.
Hiding the server address loses its value if the address shows up in another record, such as a mail record pointing to the same server, or in old DNS records. Anyone who knows the address can bypass Cloudflare and reach the server directly.
What are the common mistakes when turning on Cloudflare?
- Missing records after the DNS move. Cloudflare imports most records automatically, but go through them one by one, especially MX and TXT. A missing SPF or DKIM record sends your email to spam.
- Proxying mail records. The mail record and anything similar must stay DNS only, because the proxy carries web traffic and nothing else.
- Setting SSL to Flexible. The connection between Cloudflare and your server stays unencrypted, and if the site redirects to https it often causes an endless redirect loop. Choose Full (strict) with a valid certificate on the server. We explain certificates in SSL certificates and the "Not secure" warning.
- Caching pages that should never be cached. A rule that caches everything can show one customer's cart to another. Exclude account, cart, checkout and admin pages.
- Forgetting to purge the cache after a design change, so visitors keep seeing the old version.
Does your company website need Cloudflare?
If your audience is in more than one country, your site has been attacked before, or you want a layer of protection in front of a single server, the free plan is worth trying with a correct setup. If your site is small, its server is close to its visitors and nobody has complained about speed, the benefit is smaller, and keeping DNS and the certificate on your hosting is simpler.
We set up Cloudflare, DNS, certificates and security rules for our clients' websites as part of our hosting and server service. Send us your website link and we will tell you whether it will help and how to turn it on without affecting your email.
Questions our partners ask
Is Cloudflare free?
It has a free plan that includes the content delivery network, an SSL certificate and basic DDoS protection, which is enough for many websites. Paid plans add more security rules, more control and extra features.
Does Cloudflare affect my email?
Email does not pass through the Cloudflare proxy. Moving your DNS to Cloudflare does mean copying the MX, SPF and DKIM records exactly, though, and any missing record will stop your email or send it to spam.
Does Cloudflare replace good hosting?
No. It speeds up static files and blocks part of the attacks, but pages built on every request, such as a shopping cart or an admin panel, depend on the speed of the server itself.
Written by the Visual Innovate team, the people who build, host and follow up systems, websites and apps for our clients in Jordan, Saudi Arabia, Oman and Egypt.
