It is free, it is genuinely useful, and it is widely misunderstood. What the orange cloud does, what it does not, and the settings that break WordPress.
Cloudflare's free plan is one of the few things in this industry that is both free and genuinely excellent. It is also routinely misconfigured, occasionally oversold as a performance fix, and responsible for a specific category of baffling WordPress bugs.
What you actually get for nothing
- DNS hosting — fast, reliable, with a sane interface. Worth using even if you enable nothing else.
- A global CDN for static assets, with UK edge locations in London, Manchester and Edinburgh among 330+ cities.
- DDoS mitigation — unmetered, on the free plan, which is remarkable.
- Free SSL between visitor and Cloudflare, including for sites whose origin has no certificate.
- Basic firewall rules, bot filtering, and country blocking.
- Free email routing — forward hello@yourdomain to a personal inbox without paying for a mailbox.
- Analytics that are not Google's and do not require a cookie banner.
What it does not do
It does not make a slow site fast. This is the big misunderstanding. By default Cloudflare caches images, CSS, JavaScript and fonts — not HTML. Your WordPress page is still generated by PHP on your origin server on every request, and TTFB is unchanged. If your host is slow, Cloudflare hides it for the assets and not at all for the page itself.
To cache HTML you need a page rule, a cache rule, or Automatic Platform Optimization. That genuinely does transform TTFB — and it also means logged-in users and dynamic pages need careful bypass rules, or you will serve one customer's cart to another. Set it up deliberately, not casually.
It is not a backup, and not a security product on its own. An outdated plugin is still an outdated plugin behind a firewall.
The settings that break WordPress
- SSL mode set to "Flexible". This encrypts visitor-to-Cloudflare and then talks plain HTTP to your origin, producing infinite redirect loops and mixed-content warnings. Use Full (strict) — every host worth using offers a free origin certificate. Flexible should be considered deprecated.
- Rocket Loader. Defers JavaScript in a way that breaks sliders, forms and any script expecting normal load order. If something inexplicably stopped working the day you enabled Cloudflare, turn this off first.
- Auto Minify plus a caching plugin. Two things minifying the same files produces occasional corruption. Pick one — the plugin, usually.
- Caching wp-admin or wp-login. Always exclude
/wp-admin/*and/wp-login.phpfrom any HTML caching rule. - Forgetting to restore visitor IPs. Without it your server logs and security plugins see every request as coming from Cloudflare, which breaks rate limiting and makes Wordfence useless. Most hosts handle this automatically; check that yours does.
When you should not bother
If your host already includes a CDN and edge caching — Krystal, Hostinger, SiteGround, Kinsta and Rocket.net all do — layering Cloudflare on top adds a hop, a second cache to purge, and another place for the configuration to be wrong. Use one CDN, understood properly.
And if you are on unmanaged infrastructure like Hetzner or DigitalOcean, Cloudflare in front is close to essential — it is your DDoS protection, and hiding your origin IP is a meaningful security improvement.
Sensible default configuration: DNS through Cloudflare, proxy enabled, SSL Full (strict), Rocket Loader off, Auto Minify off, Brotli on, and a cache rule for HTML only if you understand what to exclude. That is ten minutes and costs nothing.
Published 24 May 2026. Prices and ownership change — check the comparison table for current figures, and the provider's own site before buying. No affiliate links anywhere on this site.