Cloudflare Setup – A Quick Guide

Last updated: by Janz Nordman
Cloudflare Hands On Visual
SSL/TLS Settings
Firewall Settings
Speed Settings
Caching Settings
Scrape Shield


Step 1 – To start with Cloudflare setup fill in your e-mail, strong password and “Create Account“.

Cloudflare Signup Create Account

Step 2 – Fill in your website address and “Add Site“.

Cloudflare Signup Add Site

Step 3 – You can tell Cloudflare to scan your website’s existing DNS records. Click “Next“.

Cloudflare Signup Next

Step 4 – Please choose your preferred Cloudflare plan during setup. Start with “Basic” and upgrade whenever you need it. You can “Learn more” or click on “Confirm Plan“.

Cloudflare Signup Select Plan

Step 5 – Now you need to double-check that all required DNS records are listed for your domain. Don’t worry you can modify DNS records afterward when there’s an urgent need for that. When you are confident enough, please “Continue“, otherwise consult with professionals.

Cloudflare Signup DNS Confirm

Step 6 – Change the nameservers at your domain registrar by pointing your domain to Cloudflare. When you don’t know where to start you can check “I Need Help Changing My Nameservers“. You can find over 30 step-by-step guides for most popular registrars to change the nameservers. Meanwhile, you can “Continue“.

Cloudflare Signup Change Nameservers

Step 7 – Now you need to just wait. It may take up to 24 hours after you have changed the nameserver’s DNS records. You will receive an e-mail after your setup succeeded and your website has become active on Cloudflare. Simple!

Cloudflare Signup Complete Nameserver Setup

Step 8 – Make sure your domain status has changed to “Pending Nameserver Update” to “Active“.

Cloudflare Signup Website Status

Step 9 – There is only one last thing to do. Please check your inbox and click on the confirmation e-mail link. Done? Congratulations, you have successfully signed up! Please proceed with setting up Cloudflare.

Cloudflare Signup Verified

Cloudflare Setup – SSL/TLS Settings


Your SSL/TLS encryption mode

Encrypt communication to and from your website using SSL. By default, Cloudflare provides universal SSL certificates when SSL is turned on. I strongly suggest ordering a dedicated certificate(s).

NB! Make sure that when using the „Full (strict)“ option you have a valid certificate installed on your origin server.

Edge Certificates

Edge Certificates

Manage and purchase SSL certificates that will be served to your web visitors.


  • Basic – includes Cloudflare Universal SSL certificate pack.
  • Business – enables the feature to upload any SSL certificates.

You can order a dedicated certificate with custom hostnames.

Always Use HTTPS

Redirect all requests with scheme HTTP to HTTPS. This applies to all HTTP requests to the zone. Strongly suggested to turn this feature on to force clients to use a secure connection.

NB! Your origin server must support HTTPS connection first.

Cloudflare Setting On Gray Background

HTTP Strict Transport Security (HSTS)

Enforces a web security policy for your website. This is an advanced technique and certainly recommended for online stores. You can read more about How to Submit HSTS Preload Requests.

NB! All your subdomains must support HTTPS connection and have a valid certificate installed.

Cloudflare SSL/TLS Enable HSTS

Minimum TLS Version

Only allow HTTPS connections from visitors that support the selected TLS protocol version or newer. Suggesting to allow TLS protocol since TLS 1.1 and disallow TLS 1.2 after March 2020.

Cloudflare Crypto Minimum TLS Setting

Opportunistic Encryption

If your website supports the improved performance of HTTP/2, turning on this setting is recommended. Opportunistic Encryption lets browsers to know that your site is available over an encrypted connection.

Cloudflare Setting On Gray Background

TLS 1.3

Enable the latest version of the TLS protocol for improved security and performance. Strongly suggested to enable this feature as roughly 30% of the traffic is using already TLS 1.3.

Cloudflare Crypto TLS Version Setting

Automatic HTTPS Rewrites

Automatic HTTPS Rewrites helps fix mixed content by changing HTTP to HTTPS for all resources or links on your web site that can be served with HTTPS. Strongly suggested to turn this feature on to avoid browser’s „mixed content“ errors when the usage of HTTP and HTTPS is mixed within the website.

Cloudflare Setting On Gray Background

Disable Universal SSL

Disabling Universal SSL removes any currently active Universal SSL certificates for your zone from the edge and prevents any future Universal SSL certificates from being ordered. If there are no dedicated certificates or custom certificates uploaded for the domain, visitors will be unable to access the domain over HTTPS.

NB! Make sure that you install a new dedicated SSL certificate before disabling the Universal SSL certificate.

Cloudflare Crypto Disable Universal Certificate Setting

Origin Server

Authenticated Origin Pulls

TLS client certificate presented for authentication on origin pull. This feature helps to verify whether incoming requests are originated from the Cloudflare network only.

NB! Setting this directive may require VPS or Dedicated hosting solution.

Cloudflare Setting On Gray Background


SSLVerifyClient require
SSLVerifyDepth 1
SSLCACertificateFile /path/to/origin-pull-ca.pem


ssl_client_certificate /path/to/origin-pull-ca.crt;
ssl_verify_client on;

Cloudflare Setup – Firewall Settings

Managed Rules

Web Application Firewall (WAF)

It provides enhanced security through a built-in ruleset to stop a wide range of application attacks. WAF blocks requests that contain malicious content and provides strong security without impacting performance. You will get protection for common attacks like cross-site scripting, SQL injections and many more.

NB! Strongly suggested to turn this feature on to activate security packages like OWASP, Cloudflare Rules, and any custom rules.

Cloudflare Setting On Gray Background
Pro Plan

Cloudflare Managed Ruleset

Cloudflare’s Managed Ruleset has been created by Cloudflare security engineers and is designed to provide fast and performant protection for your applications. This ruleset is updated and improved on a frequent basis to cover new vulnerabilities and to improve false-positive rates.

NB! Strongly recommended to enable at least „Cloudflare specials“ and when using WordPress „Cloudflare Php“ and „Cloudflare WordPress“ should be also enabled.

Cloudflare Setting On Gray Background
Pro Plan

Package: OWASP ModSecurity Core Rule Set

Covers OWASP Top 10 vulnerabilities, and more. I strongly do recommend to turn on the most OWASP rules when your website e.g. online store collects and stores some valuable data desired by the hackers.

NB! When running the WordPress website „OWASP Slr Et WordPress Attacks“ ruleset is a must to turn on.

Cloudflare Firewall OWASP Setting
Pro Plan


Security Level

Adjust your website’s Security Level to determine which visitors will receive a challenge page.

NB! When running a website containing customer’s data you should set this setting at least to “Medium”.

Cloudflare Firewall Security Level Setting

Bot Fight Mode

There are thousands if not millions of bots out there and these automated workers may slow down your website significantly when making requests often. Turning on this option is highly recommended.

Cloudflare Setting On Gray Background

Challenge Passage

Specify how long a visitor with a bad IP reputation is allowed access to your website after completing a challenge. After the Challenge Passage TTL expires, the visitor in question will have to pass a new Challenge.

Browser Integrity Check

Evaluate HTTP headers from your visitors’ browser for threats. If a threat is found a block page will be delivered.

NB! This may block access to your API. You can selectively enable or disable this feature for any part of your domain using page rules.

Cloudflare Setting On Gray Background

Privacy Pass Support

Privacy Pass is a browser extension developed by the Privacy Pass Team to improve the browsing experience for your visitors. Enabling Privacy Pass will reduce the number of CAPTCHAs shown to your visitors.

NB! This works only for the websites using Cloudflare.

Cloudflare Setting On Gray Background

Cloudflare Setup – Speed Settings



Improve image load time by optimizing images hosted on your domain. Optionally, the WebP image codec can be used with supported clients for additional performance benefits.

NB! Purge cache to have your change take effect immediately.

Cloudflare Speed Polish Setting
Pro Plan

Auto Minify

Reduce the file size of the source code on your website.

NB! Purge cache to have your change take effect immediately.

Cloudflare Speed Auto Minify Setting


Speed up page load times for your visitor’s HTTPS traffic by applying Brotli compression.

Cloudflare Setting On Gray Background

Enhanced HTTP/2 Prioritization

When enabled, resources will be delivered in the optimal order for the fastest experience across all browsers. Read more on Cloudflare’s Blog Post.

Cloudflare Setting On Gray Background

TCP Turbo

Enabled automatically, reduces latency and throughput over TCP connection.

NB! Only disabled for free plans.

Cloudflare TCP Turbo Enabled

Rocket Loader™

Improve the paint time for pages that include Javascript. You can have Rocket Loader ignore individual scripts by adding the data-cfasync="false" attribute to the relevant script tag, for example:

<script data-cfasync="false" src="/path-to-your-javascript.js"></script>

Cloudflare Setting On Gray Background

Cloudflare Setup – Caching Settings

Purge Cache

Clear cached files to force Cloudflare to fetch a fresh version of those files from your web server. You can purge files selectively or all at once.

NB! Purging the cache may temporarily degrade performance for your website and increase the load on your origin.

Cloudflare Caching Purge Cache Setting

Caching Level

Determine how much of your website’s static content you want to cache. Increased caching can speed up page load time. You can set cache static content according to these levels:

  • No Query String – only delivers files from the cache when there is no query string.
  • Ignore Query String – delivers the same resource to everyone independent of the query string.
  • Standard – delivers a different resource each time the query string changes.

Browser Cache TTL

Determine the length of time Cloudflare instructs a visitor’s browser to cache files. During this period, the browser loads the files from its local cache, speeding up page loads. Therefore, it’s up to you how long you set the cache period. Set it to a longer period when your website’s content doesn’t change that often.

Always Online™

If your server goes down, Cloudflare will serve your website’s static pages from their cache.

Cloudflare Setting On Gray Background

Development Mode

Temporarily (lasts for three hours) bypass cache allowing you to see changes to your origin server in realtime.

NB! Enabling this feature can significantly increase the origin server load. Development mode does not purge the cache so files will need to be purged after development mode expires.

Cloudflare Setting Off Gray Background

Reliable and Recognized Web Hosting Partners

Overview of Best WordPress Hosting Providers

SiteGround Logo
Best Uptime (99.99%)
Fastest Load Time (141ms)
Starting Cost ($3.95/mo)
Integrated Cloudflare Support

Provides auto-scalable cloud hosting for high-performing sites. Go to SiteGround.

GoDaddy Logo
Good Uptime (99.95%)
Fast Load Time (147ms)
Starting Cost ($6.99/mo)
Integrated Cloudflare Support

One of the most popular and leading web hosting solutions company on the market. Go to GoDaddy.

A2 Hosting Logo
Best Uptime (99.99%)
Good Load Time (182ms)
Starting Cost ($3.92/mo)
Integrated Cloudflare Support
Integrated LiteSpeed Web Server

The fastest WordPress stack with LiteSpeed server technology provided by A2 Hosting.

Source HostScore

Cloudflare Setup – Network


HTTP/2 improves the way HTTP requests and responses are sent over the Internet by allowing faster page load times. According to W3Techs 44% of the top 10 million websites support HTTP/2. Turn this switch on to be part of this league.

NB! Free plans can’t disable this option.

Cloudflare Setting On Gray Background

HTTP/3 (with QUIC)

HTTP/3 is the next version of the network protocol designed to take advantage of QUIC, a new Internet transport protocol that provides a number of improvements designed to accelerate HTTP traffic. Turn this switch on to gain encryption and performance improvements compared to TCP and TLS.

Cloudflare Setting On Gray Background

0-RTT Connection Resumption

Turn this switch on to improves performance for clients who have previously connected to your website.

Cloudflare Setting On Gray Background


When you have a mission-critical real time application, you can allow web socket connections to your origin server. Otherwise turn this feature off.

Cloudflare Setting Off Gray Background

Onion Routing

Onion Routing allows routing traffic from legitimate users on the Tor network through Cloudflare’s onion services rather than exit nodes, thereby improving the privacy of the users and enabling more fine-grained protection. It doesn’t make any harm to turn this feature on.

Cloudflare Setting On Gray Background

Scrape Shield

Email Address Obfuscation

Cloudflare can obfuscate e-mail addresses found on your website to stop harvesters and bots getting e-mail addresses for spamming purposes, but still visible to human visitors. Please keep this setting enabled to make spammers’ life as harder as possible.

Cloudflare Setting On Gray Background

Server-side Excludes

If you have some sensitive content on your webpage and you would like to hide this from suspicious visitors, enable this option. Put everything between SSE tags and Cloudflare will show this wrapped content only to real users.

<!--sse-->Suspicious visitors won’t see my phone number, (+372) 5 555 555<!--/sse-->

Cloudflare Setting On Gray Background

Hotlink Protection

Hotlink Protection prevents your images from being used by other websites. When consumed by other websites this can reduce the bandwidth of your origin server. As a result, visitors of your website will still be able to download and view images.

NB! You can still hotlink images by putting them into /hotlink-ok/ sub-folder and Cloudflare will allow them to consume by other websites.

Cloudflare Setting On Gray Background

Leave Comment

Your email address will not be published. Required fields are marked *