Cloudflare provides free CDN, DDoS protection, and WAF for WordPress sites. Critical: set SSL to Full Strict or you will get redirect loops.
DNS Setup (Nameserver Method)
- Add site to Cloudflare > Select Free plan
- Cloudflare scans existing DNS records
- Review and confirm all records (A, CNAME, MX, TXT)
- Update nameservers at domain registrar to Cloudflare nameservers
- Propagation: 5-60 minutes
Critical DNS Proxy Settings
| Record | Proxy Status | Why | |--------|-------------|-----| | @ (root) | Proxied (orange cloud) | CDN + DDoS protection | | www | Proxied (orange cloud) | Same | | mail | DNS only (gray cloud) | Email CANNOT go through Cloudflare proxy | | ftp | DNS only | Same |
SSL/TLS Mode — Use Full (Strict)
Cloudflare > SSL/TLS > Overview: Full (strict)
- "Flexible" causes 301 redirect loops in WordPress (WordPress forces HTTPS, Cloudflare serves HTTP to server)
- Full (strict) requires a valid SSL cert on origin server (Let's Encrypt via host, or Cloudflare Origin Certificate)
Page Rules (Free Plan — 3 Rules)
# Rule 1: Bypass cache for admin and dynamic pages
URL: example.com/wp-admin/*
Setting: Cache Level = Bypass
# Rule 2: Aggressive cache for static assets
URL: example.com/wp-content/*
Settings: Cache Level = Cache Everything, Edge Cache TTL = 1 month
# Rule 3: Security on login page
URL: example.com/wp-login.php
Setting: Security Level = High
WAF Firewall Rules
Block bad bots (Cloudflare > Security > WAF > Custom Rules):
Rule: Block Known Bad Bots
Expression:
(http.user_agent contains "Scrapy") or
(http.user_agent contains "python-requests") or
(http.user_agent contains "Go-http-client") or
(http.user_agent contains "zgrab")
Action: Block
Country challenge (if needed):
(ip.geoip.country in {"CN" "RU" "KP"})
Action: Challenge
WooCommerce Exclusions
Never cache checkout, cart, or my-account URLs:
URL: example.com/checkout/*
Setting: Cache Level = Bypass
URL: example.com/cart/*
Setting: Cache Level = Bypass
Also disable Cloudflare cache for logged-in users by enabling "Bypass Cache on Cookie" (requires paid plan) or handle via WP Rocket Cloudflare add-on.
Cloudflare Analytics
Free plan includes: Total requests, bandwidth, threats blocked, unique visitors. Check weekly for bot attack spikes.