How to set up free Cloudflare for a WordPress site
· The AYT team · 6 min read
Cloudflare's free plan puts a network of servers between your visitors and your site. Images, CSS and JavaScript files come from the Cloudflare location nearest the visitor, and part of the malicious traffic stops before it reaches your server. For an ordinary WordPress site, the setup takes about half an hour.
At AYT, you don't move DNS records by hand. The panel connects to your Cloudflare account with an API token, copies the records both ways by itself, and from then on you edit them in the panel.
1. Add the domain to Cloudflare
Create an account on cloudflare.com, add your domain and choose the Free plan. Cloudflare reads the existing DNS records and shows them in a list. You don't need to check them one by one. In step 3 the panel sends Cloudflare the addresses for your site and email, and whatever was already in Cloudflare (other subdomains, TXT verification records) is copied into the panel too.
Cloudflare also gives you two nameservers, in the form name.ns.cloudflare.com. Write them down for step 4.
2. Create an API token
The token lets the panel read and change the DNS records of one domain. It has no access to the rest of your Cloudflare account.
- In Cloudflare, open your profile (the icon at the top right) → API Tokens → Create Token.
- Pick the "Edit zone DNS" template.
- Under Permissions, add a row with Zone → Zone → Read, next to the Zone → DNS → Edit row the template adds.
- Under Zone Resources, keep Include → Specific zone and choose your domain.
- Click Continue to summary, then Create Token, and copy the token. Cloudflare shows it only once.
3. Put the token in the AYT panel
In the panel, open DNS → DNS records and pick the domain. In the "DNS provider: this server" box, paste the token into the "Cloudflare API token" field and click "Use Cloudflare".
The panel finds the zone by name and brings the two lists into line. The AYT server's addresses for the domain, www, subdomains and email go to Cloudflare, and records that only existed in Cloudflare are copied into the panel. From now on, whatever you add or change in DNS records goes straight to your Cloudflare zone.
If the domain was on Cloudflare before it came to AYT, its DNS page has a "Connect Cloudflare" button. Paste a token made the same way there. The records in Cloudflare stay as they are, and from now on you manage them in the panel.
You can also give the token when you add the site, in the form's advanced options.
4. Change the nameservers
At your domain registrar, replace the old nameservers with the two Cloudflare gave you. Activation takes anywhere from a few minutes to a few hours, and Cloudflare emails you when it's done.
5. Turn on the proxy where you want it
Records the panel writes start as "DNS only": Cloudflare only answers DNS queries, and visitors reach the server directly. To route the site through Cloudflare, switch on Proxy in the DNS records list for the domain and for www. The switch appears only on A, AAAA and CNAME records.
The names used for email and FTP (mail, webmail, ftp) stay unproxied, because Cloudflare's proxy carries only web traffic. IMAP, SMTP and FTP don't go through it.
With the proxy on, AYT's servers read the visitor's real address from the header Cloudflare sends. Logs, statistics, the firewall and failed-login blocking keep working with your visitors' addresses.
6. SSL mode: Full (strict)
The next steps happen in Cloudflare, because the token only covers DNS. In SSL/TLS → Overview you choose how Cloudflare encrypts the path to your server. At AYT every domain already has a Let's Encrypt certificate, so choose Full (strict). Cloudflare then encrypts the connection to the server and checks its certificate.
Avoid Flexible mode. With it, Cloudflare talks to the server over plain HTTP, and WordPress, which knows its address starts with https://, keeps sending it back to HTTPS. The visitor sees a "too many redirects" error.
In the same section, under Edge Certificates, turn on "Always Use HTTPS".
7. Caching
With the default settings, Cloudflare caches only static files, by extension: images, CSS, JavaScript, fonts. HTML pages always go to the server. For most WordPress sites that's the safe choice, and you can leave it as it is.
If you want to cache pages too, with a "Cache Everything" rule, the rule has to leave out:
/wp-admin/and/wp-login.php;- the cart, checkout and "My account" pages, on WooCommerce;
- logged-in visitors and visitors with products in their cart, based on the
wordpress_logged_in_andwoocommerce_items_in_cartcookies.
If you can't set up all of these exceptions, don't cache HTML: a customer could get another customer's page from the cache, with that person's name and address on it. At AYT, the nginx page cache skips the cart and checkout by itself, so you don't need "Cache Everything".
After a theme or CSS change, purge the cache from Caching → Configuration → Purge Everything, or some visitors will see the old files.
8. Security
For the login page, you can create a rule in Security → WAF that issues a "Managed Challenge" to requests for /wp-login.php. Most bots stop there, and people usually pass the check without doing anything.
"Bot Fight Mode" stops many bots, but on the free plan you can't make exceptions. If your site receives notifications from a payment processor, a courier or other apps, check after turning it on that they still get through.
"Under Attack Mode" shows every visitor a check page for a few seconds. Turn it on during an attack and off afterwards.
If your theme or payment plugin behaves oddly after you add Cloudflare, first turn off Rocket Loader in Speed → Optimization. It changes the order in which scripts load, and sometimes buttons stop responding.
If you change your mind
Click "Move DNS back to this server" in the panel's "DNS provider" box. Cloudflare's records are copied back to the AYT server, and at your registrar you set the AYT nameservers again. Your Cloudflare zone stays as it was.
DNS through your own Cloudflare account, edited from the panel, is one of the features included in every AYT account.
