Cloudflare Free for WordPress: Configure the Connection, Then the Rules

Cloudflare can sit between visitors and your WordPress server, while also publishing the domain’s DNS records. Used carefully, it becomes a useful part of delivery and protection. Configured without understanding the origin, it can introduce certificate errors, stale content, or blocked legitimate requests.

I use Cloudflare Free as the starting plan for this setup. The objective is a small, understandable configuration that fits the website. This guide connects Cloudflare to the wider website infrastructure and explains how to verify each stage.

Start with an inventory and a working origin

Before changing delegation, record the existing DNS zone and services. Include website hostnames, mail records, verification records, and integrations. Confirm that the destination web server is configured for the domain.

Establish working origin HTTPS and a recovery route to the server or panel. If the domain is not yet pointed at the server, an implementer can use a controlled local hostname override to test the intended virtual host. Opening the bare IP address is not equivalent to requesting the domain with the correct TLS hostname.

Do not switch DNS, change the server stack, enable new cache rules, and introduce several security rules in one unrecorded step. A staged transition makes the source of a problem easier to identify.

Add the zone and verify the records

Create the domain in the client-controlled Cloudflare account and select the intended plan. Review the imported records against the actual current zone. Add missing entries before updating the registrar’s nameservers.

Handle existing DNSSEC through the supported migration process. After delegation changes, confirm the active authoritative nameservers and the published records. The domain and DNS guide provides this sequence in detail.

Changing nameservers does not transfer the website, create mailboxes, or move stored email. It changes who answers DNS for the domain.

Choose which hostnames use the proxy

Cloudflare’s proxy setting determines whether eligible web traffic passes through its network or goes directly to the configured destination. A DNS-only record can still be managed in Cloudflare without receiving the proxy’s web-delivery behavior.

Use proxying deliberately for the web hostnames that should pass through Cloudflare. Mail-related services and other non-web destinations need the configuration their provider requires. MX records themselves are not web-proxy records, and hostnames used for mail service should not be treated like the public website. Cloudflare proxy status

Record the reason for exceptions. Third-party verification or an external service may require a DNS-only entry. An administrative endpoint should follow its own access design rather than simply copying the website’s setting.

Secure both HTTPS connections

With the proxy active, there are two connections to consider:

Use Full (strict) when the origin meets its requirements. It validates the origin certificate, which can be publicly trusted or issued by Cloudflare Origin CA. An encrypted connection without validation is a different security property. Full (strict) requirements

Choose the origin certificate with the recovery design in mind. Cloudflare Origin CA certificates are intended for the Cloudflare-to-origin connection. Browsers generally do not trust them for direct visits if proxying is disabled. A publicly trusted origin certificate can simplify a direct-access fallback, provided network policy also permits it. Origin CA documentation

Do not use a weaker mode as a permanent workaround for an invalid origin certificate. Correct the certificate or server configuration and retest.

Make redirects predictable

Choose the preferred hostname and HTTPS behavior. Review redirects at Cloudflare, Nginx, and WordPress together. Conflicting rules can bounce requests between HTTP and HTTPS or between www and the root domain.

Test each public entry point: HTTP and HTTPS, with and without www where those names are used. They should reach the intended destination without an excessive chain or loop.

Be cautious when enabling long-lived browser policies such as HSTS before the HTTPS arrangement is stable across the relevant hostnames. Such policies are not simply a performance checkbox and can affect recovery from a certificate mistake.

Keep the redirect design documented so later changes do not accidentally create a second authority for the same behavior.

Start caching with a clear boundary

Cloudflare’s ordinary cache behavior does not cache HTML or JSON by default. Do not assume that enabling the proxy automatically caches every WordPress page. Default cache behavior

For this stack, begin with an understood static-resource policy and the origin’s Nginx page cache. Full-page edge caching is an additional design decision. If introduced, it needs rules for sessions, cookies, private responses, previews, forms, WooCommerce, and invalidation.

Separate Edge TTL, which concerns Cloudflare’s retained content, from Browser TTL, which concerns reuse by the visitor’s browser. Review browser policy alongside FASTPANEL’s static-file settings so one layer does not unexpectedly lengthen the other. Edge and browser cache TTL

The caching guide covers the complete relationship between Nginx, Redis, Cloudflare, and browser caches. The correct policy matters more than maximizing the cache-hit percentage for every request.

Apply protection without blocking the business

The Free plan has access to Cloudflare’s Free Managed Ruleset; it is not equivalent to every managed ruleset or feature on paid plans. Verify current entitlements when configuring the account. Cloudflare WAF availability

Introduce custom restrictions for a defined reason. Review the path, method, source, and legitimate users affected. Broad country blocks, blanket bot challenges, or aggressive limits can interfere with customers, integrations, monitoring, and payment callbacks.

Test forms, login, password reset, media uploads, and any store or CRM integration after a material rule change. A browser test alone may miss a machine-to-machine callback that cannot complete an interactive challenge.

When a rule blocks valid traffic, identify the specific rule and request before making an exception. Avoid disabling all protection as the default repair. The security guide explains how edge protection connects with server access controls.

Do not assume the origin is hidden or maintained

Proxying a public hostname does not prove that the origin cannot be reached directly or that its IP address has never been exposed. Historical DNS, other records, and network configuration can leave other routes to the server.

If the origin’s web ports are restricted to Cloudflare, preserve the required management, certificate-validation, and recovery paths. The restrictions need maintenance as dependencies change. Do not apply an unexplained firewall rule that locks the owner out of the panel or prevents certificate renewal.

Cloudflare also does not update WordPress, maintain PHP, or restore a damaged database. Those tasks remain with the responsible maintainer.

Verify with an evidence checklist

After setup, record the results rather than just the enabled switches:

• The expected nameservers and DNS records are active.
• Public web hostnames follow the intended proxied path.
• Mail reception and sending still work.
• The edge certificate and origin TLS configuration are valid.
• Alternate public URLs resolve to the preferred address correctly.
• Edited content and changed static resources become visible as intended.
• Forms, administrative tasks, and integration callbacks still complete.
• The owner can reach the Cloudflare account and recover access.

Inspect response headers where useful. CF-Cache-Status describes the relevant Cloudflare cache outcome; it does not report every cache behind it. A WordPress page can be served from Nginx’s cache while remaining uncached at Cloudflare.

Troubleshoot the symptom at its layer

Origin connection errors: verify the server is reachable, the service is running, and firewall rules allow the expected path. Do not assume that the domain registration is the cause.

Certificate validation errors: inspect the origin certificate, hostname, chain, and validity. Check whether the server is presenting the correct certificate for that hostname.

Redirect loops: compare the encryption arrangement with redirects in Cloudflare, Nginx, and WordPress. Review which component believes the request is already HTTPS.

Old content: identify the cached resource and layer. Test with normal browser caching and then diagnostic cache controls; inspect Cloudflare and origin behavior separately. Clearing an edge cache does not recall a still-fresh browser copy.

Blocked submissions or callbacks: inspect the relevant security event and match it to the legitimate request. Retest the full transaction after a narrowly scoped change.

Frequently asked questions

Is Cloudflare Free sufficient for every WordPress website?

It can be a useful starting point, but suitability follows the requirements. Advanced protection, larger limits, or particular services may require another plan or product. The setup should identify the actual need before recommending an upgrade.

Does the orange-cloud proxy move my site to Cloudflare?

No. The WordPress application remains on its origin. Cloudflare participates in the request path and may serve eligible cached resources, while the origin remains responsible for the application and dynamic work.

Can I use Zoho Mail while Cloudflare manages DNS?

Yes. Publish the correct Zoho records in the active zone and keep mail-related services configured as required. The Zoho email guide explains verification and testing.

Should I cache the entire website at the edge?

Only after defining safe eligibility and invalidation. Logged-in activity, cart, checkout, account pages, and other personalized responses need particular treatment. Starting with a smaller verified policy is preferable to discovering session errors after launch.

Can I temporarily disable Cloudflare to troubleshoot?

That can change several things at once: DNS behavior, protection, certificate trust, and the allowed network path. Establish whether direct origin access is valid before doing so. A controlled origin test can be more informative than a broad production change.

Does Cloudflare remove the need for server monitoring?

No. The origin can still run out of memory, fill its disk, fail an update, or stop executing background tasks. Those conditions belong in server maintenance.

Configure Cloudflare as part of a working system

I can connect Cloudflare Free to your domain and WordPress infrastructure and verify the important interactions. Describe the site and the services it needs to support; account access can be arranged securely after the scope is clear.

Discuss my Cloudflare setup