In this guide 6 sections
Cloudflare sits in front of your website and does four jobs: it answers DNS lookups, caches static files, supplies the HTTPS certificate and filters hostile traffic. It does not secure a weak admin password, speed up a slow database query or patch an outdated plugin. Those stay with you.
Job one: answering DNS
When someone types your domain, a DNS server turns the name into a server address. Cloudflare can hold that record set and answer from data centres near the visitor.
You edit your A, CNAME and MX records in its dashboard. Moving name servers is the step that puts Cloudflare in the path.
One caution. Copy every existing record before the switch, especially MX entries for email and any TXT records for SPF or DKIM. A forgotten mail record means invoices stop arriving.
Job two: caching static files
Images, stylesheets and scripts rarely change. Cloudflare stores copies near visitors and serves them without bothering your origin server. A customer far from your host sees pages sooner. Your server does less work.
Pages that differ per user are another matter. A cart, a dashboard and a logged-in portal must not be cached. Set rules so that paths like /account and /checkout bypass the cache.
Cached copies go stale. After a deployment, purge the cache. Otherwise visitors see yesterday’s stylesheet.
- Product images and logo files
- CSS and JavaScript bundles
- Downloadable PDFs such as brochures
- Never the cart, checkout or admin pages
Jobs three and four: certificates and filtering
Cloudflare issues the certificate that gives visitors the padlock and encrypts their connection. Choose the full strict mode, which also encrypts the hop between Cloudflare and your server. The looser flexible mode leaves that hop open.
Filtering covers a web application firewall, rate limits and bot checks. It blocks floods of login attempts, scrapers and known attack patterns before they reach you.
Rules need tuning. A firewall set too tight blocks your own payment gateway’s webhook callback. Orders then fail quietly.
What Cloudflare leaves to you
It cannot repair a weak admin login. If your WordPress or Laravel back office accepts a guessable password, a human can still log in through Cloudflare. Add two-factor sign-in and limit who can reach /admin.
It cannot speed up a slow query. If a sales report takes eleven seconds because the orders table lacks an index, caching will not help, since each report request is unique.
It also does not update software. An old plugin with a known flaw remains exploitable, though the firewall may soften some attacks. Patch it.
- Admin passwords and two-factor sign-in
- Database indexes and heavy queries
- Plugin, framework and server updates
- Backups and a tested restore
A sensible first week
Day one, export your current DNS records. Day two, add the site, recreate the records and compare them line by line. Switch name servers outside business hours.
Then test the checkout, the contact form, the OTP email and the admin login from a phone on mobile data. These four flows break first when caching or firewall rules are wrong.
Keep the old DNS export somewhere safe, so a rollback takes minutes.
Cloudflare switch-over checklist
The checklist runs to one page, split into three blocks: before, during and after the name server change. Before lists the DNS export, mail records and certificate mode. During lists the cache bypass paths and firewall rules. After lists the four flow tests with a pass or fail box and the rollback contact.
Open a blank worksheet to printQuestions owners ask
Will Cloudflare make my website faster?
For static files, usually yes, especially for visitors far from your server. Slow code and slow queries behind the cache stay slow.
Does Cloudflare replace my web host?
No. Your site still lives on your own server or host. Cloudflare stands in front of it.
Can Cloudflare stop all hacking attempts?
No tool can. It reduces automated attacks, but weak passwords and unpatched software are still routes in.
Who should hold the Cloudflare login?
The business, using a company email and two-factor sign-in. Do not leave the account under a former developer’s personal address.