For most small and medium companies, Cloudflare is the cheapest security and performance upgrade available. Moving DNS to Cloudflare takes an hour and immediately gives you a global network in front of your servers. The value comes from configuring it properly.
DNS and the orange cloud
Proxy (orange cloud) every web record so visitors reach Cloudflare, not your server. Keep mail records (MX and the hosts they point to) DNS-only. Be careful: if a DNS-only record such as mail.example.com points to the same IP as your website, it exposes your origin and attackers can bypass Cloudflare entirely.
TLS done right
- Set SSL/TLS mode to Full (strict) and install a Cloudflare Origin Certificate or a Let's Encrypt certificate on the server.
- Enable Always Use HTTPS and automatic HTTPS rewrites.
- Turn on HSTS only after you are sure every subdomain supports HTTPS.
WAF and rate limiting
Enable the managed WAF rules available on your plan, then add a few custom rules: block or challenge access to /wp-login.php, /xmlrpc.php and admin paths from outside your country, and add a rate-limiting rule on login and contact endpoints. Bot Fight Mode removes a lot of noise from the logs.
Lock the origin
Your server firewall should accept HTTP and HTTPS only from Cloudflare's published IP ranges. Otherwise the WAF is just a suggestion.
Zero Trust instead of open ports
Cloudflare Tunnel lets you publish an internal app (a dashboard, n8n, an ERP test server) without opening any inbound port: a small connector on the server makes an outbound connection to Cloudflare. Put Cloudflare Access in front of it and users must sign in with their company email before they even see the login page.
Cache what is static
Static assets with hashed names can be cached for a year. HTML can be cached at the edge for static sites. The result is faster pages for visitors and less load on a small server.
