{"slug":"cloudflare-wordpress-cdn","title":"Cloudflare WordPress CDN Setup","tags":["cloudflare","cdn","dns","ssl","performance","waf"],"agent_summary":"Cloudflare setup for WordPress: nameserver migration, DNS proxy rules, SSL/TLS Full Strict mode to prevent redirect loops, page rules for cache bypass and aggressive static caching, WAF firewall rules for bad bots, and WooCommerce checkout exclusions.","trigger_phrases":["cloudflare wordpress","cloudflare cdn setup","cloudflare dns wordpress","cloudflare ssl redirect loop","cloudflare page rules wordpress","cloudflare waf wordpress","cloudflare woocommerce"],"runnable":true,"markdown":"\nCloudflare provides free CDN, DDoS protection, and WAF for WordPress sites. Critical: set SSL to Full Strict or you will get redirect loops.\n\n## DNS Setup (Nameserver Method)\n\n1. Add site to Cloudflare > Select Free plan\n2. Cloudflare scans existing DNS records\n3. Review and confirm all records (A, CNAME, MX, TXT)\n4. Update nameservers at domain registrar to Cloudflare nameservers\n5. Propagation: 5-60 minutes\n\n## Critical DNS Proxy Settings\n\n| Record | Proxy Status | Why |\n|--------|-------------|-----|\n| @ (root) | Proxied (orange cloud) | CDN + DDoS protection |\n| www | Proxied (orange cloud) | Same |\n| mail | DNS only (gray cloud) | Email CANNOT go through Cloudflare proxy |\n| ftp | DNS only | Same |\n\n## SSL/TLS Mode — Use Full (Strict)\n\nCloudflare > SSL/TLS > Overview: **Full (strict)**\n\n- \"Flexible\" causes 301 redirect loops in WordPress (WordPress forces HTTPS, Cloudflare serves HTTP to server)\n- Full (strict) requires a valid SSL cert on origin server (Let's Encrypt via host, or Cloudflare Origin Certificate)\n\n## Page Rules (Free Plan — 3 Rules)\n\n```\n# Rule 1: Bypass cache for admin and dynamic pages\nURL: example.com/wp-admin/*\nSetting: Cache Level = Bypass\n\n# Rule 2: Aggressive cache for static assets\nURL: example.com/wp-content/*\nSettings: Cache Level = Cache Everything, Edge Cache TTL = 1 month\n\n# Rule 3: Security on login page\nURL: example.com/wp-login.php\nSetting: Security Level = High\n```\n\n## WAF Firewall Rules\n\nBlock bad bots (Cloudflare > Security > WAF > Custom Rules):\n\n```\nRule: Block Known Bad Bots\nExpression:\n(http.user_agent contains \"Scrapy\") or\n(http.user_agent contains \"python-requests\") or\n(http.user_agent contains \"Go-http-client\") or\n(http.user_agent contains \"zgrab\")\nAction: Block\n```\n\nCountry challenge (if needed):\n```\n(ip.geoip.country in {\"CN\" \"RU\" \"KP\"})\nAction: Challenge\n```\n\n## WooCommerce Exclusions\n\nNever cache checkout, cart, or my-account URLs:\n\n```\nURL: example.com/checkout/*\nSetting: Cache Level = Bypass\n\nURL: example.com/cart/*\nSetting: Cache Level = Bypass\n```\n\nAlso disable Cloudflare cache for logged-in users by enabling \"Bypass Cache on Cookie\" (requires paid plan) or handle via WP Rocket Cloudflare add-on.\n\n## Cloudflare Analytics\n\nFree plan includes: Total requests, bandwidth, threats blocked, unique visitors. Check weekly for bot attack spikes.\n","html":"<p>Cloudflare provides free CDN, DDoS protection, and WAF for WordPress sites. Critical: set SSL to Full Strict or you will get redirect loops.</p>\n<h2>DNS Setup (Nameserver Method)</h2>\n<ol>\n<li>Add site to Cloudflare > Select Free plan</li>\n<li>Cloudflare scans existing DNS records</li>\n<li>Review and confirm all records (A, CNAME, MX, TXT)</li>\n<li>Update nameservers at domain registrar to Cloudflare nameservers</li>\n<li>Propagation: 5-60 minutes</li>\n</ol>\n<h2>Critical DNS Proxy Settings</h2>\n<p>| Record | Proxy Status | Why |\n|--------|-------------|-----|\n| @ (root) | Proxied (orange cloud) | CDN + DDoS protection |\n| www | Proxied (orange cloud) | Same |\n| mail | DNS only (gray cloud) | Email CANNOT go through Cloudflare proxy |\n| ftp | DNS only | Same |</p>\n<h2>SSL/TLS Mode — Use Full (Strict)</h2>\n<p>Cloudflare > SSL/TLS > Overview: <strong>Full (strict)</strong></p>\n<ul>\n<li>\"Flexible\" causes 301 redirect loops in WordPress (WordPress forces HTTPS, Cloudflare serves HTTP to server)</li>\n<li>Full (strict) requires a valid SSL cert on origin server (Let's Encrypt via host, or Cloudflare Origin Certificate)</li>\n</ul>\n<h2>Page Rules (Free Plan — 3 Rules)</h2>\n<pre><code># Rule 1: Bypass cache for admin and dynamic pages\nURL: example.com/wp-admin/*\nSetting: Cache Level = Bypass\n\n# Rule 2: Aggressive cache for static assets\nURL: example.com/wp-content/*\nSettings: Cache Level = Cache Everything, Edge Cache TTL = 1 month\n\n# Rule 3: Security on login page\nURL: example.com/wp-login.php\nSetting: Security Level = High\n</code></pre>\n<h2>WAF Firewall Rules</h2>\n<p>Block bad bots (Cloudflare > Security > WAF > Custom Rules):</p>\n<pre><code>Rule: Block Known Bad Bots\nExpression:\n(http.user_agent contains \"Scrapy\") or\n(http.user_agent contains \"python-requests\") or\n(http.user_agent contains \"Go-http-client\") or\n(http.user_agent contains \"zgrab\")\nAction: Block\n</code></pre>\n<p>Country challenge (if needed):</p>\n<pre><code>(ip.geoip.country in {\"CN\" \"RU\" \"KP\"})\nAction: Challenge\n</code></pre>\n<h2>WooCommerce Exclusions</h2>\n<p>Never cache checkout, cart, or my-account URLs:</p>\n<pre><code>URL: example.com/checkout/*\nSetting: Cache Level = Bypass\n\nURL: example.com/cart/*\nSetting: Cache Level = Bypass\n</code></pre>\n<p>Also disable Cloudflare cache for logged-in users by enabling \"Bypass Cache on Cookie\" (requires paid plan) or handle via WP Rocket Cloudflare add-on.</p>\n<h2>Cloudflare Analytics</h2>\n<p>Free plan includes: Total requests, bandwidth, threats blocked, unique visitors. Check weekly for bot attack spikes.</p>\n"}