• Skip to primary navigation
  • Skip to content
  • Skip to footer

Jordon Rupp

WordPress Developer

  • Portfolio
  • Blog
  • Get in Touch

How To Set Up Cloudflare With WordPress: Complete Guide

You are here: Home / WordPress / How To Set Up Cloudflare With WordPress: Complete Guide

December 15, 2017 By Jordon Rupp

If you’re like most WordPress site owners and implementers, security and performance are two topics that are dear to your heart.

So if I told you that there was one service that can both secure your site and make it load faster, you’d probably be pretty interested, right?

That’s what Cloudflare can do. And Cloudflare is what I’m going to talk about in this post.

I’ll tell you what it does, how it helps your site, and, most importantly, how to set up Cloudflare for WordPress the right way.

What Is Cloudflare And How Does It Help Your Site?

Cloudflare is a DNS, security, and content delivery network (CDN) service that speeds up and secures your website.

When you set your website up with Cloudflare, you’re essentially routing all your traffic through Cloudflare’s global network. This leads to a number of benefits like:

  • Faster page load times – because Cloudflare caches your content across its network, you get all the speed benefits of a content delivery network.
  • Decreased bandwidth usage – again – because Cloudflare caches your content on its own network, you’ll use less bandwidth to serve up your website.
  • Clean traffic – Cloudflare filters out bot traffic and other negative traffic sources.
  • Enhanced security – Cloudflare offers a web application firewall, DDoS protection, and free SSL to secure your website, though not all of these features are available in its free plan.

In addition to its security benefits, Cloudflare claims that, on average, it’s able to reduce bandwidth usage by 60% and cut page load times by 50%.

How Cloudflare Uses DNS To Power Its Service

At a high level, Cloudflare works by controlling your website’s DNS, short for domain name system.

DNS is basically the system that connects your domain name with the actual IP address of your web server. People call it the “phone book of the Internet.”

You type a human-readable URL into your browser toolbar and then DNS is what translates and routes that human-readable text into a machine-readable IP address.

To route that traffic, DNS uses something called nameservers, which are essentially a collection of records. These individual record types are:

  • A – contains the IP address(es) for your domain and subdomains
  • MX – specifies where email should be delivered for your domain
  • CNAME – lets you set up redirects from one subdomain to another domain/subdomain
  • TXT – lets you store additional information, like SPF for email verification

Cloudflare works by inserting itself into this process as the nameservers for your domain.

Essentially, this lets Cloudflare handle routing your traffic, which means that when a visitor tries to access your site, Cloudflare is able to:

  • Scan incoming traffic to see if it’s a threat (for better security)
  • Route that traffic to the closest data center in Cloudflare’s global network (for content delivery and improved page load times)

Note – If you’d prefer, you can also just use Cloudflare as a standalone DNS service and eschew the security and CDN elements.

How To Add Cloudflare To Your WordPress Website In 5 Minutes

The basic process for setting up your website with Cloudflare is surprisingly easy and doesn’t require any software or hardware, which is one of the major benefits of Cloudflare

Here it is in a nutshell:

  • Sign up at Cloudflare
  • Add your site and let Cloudflare scan its DNS records
  • Confirm and clean up DNS records (if needed)
  • Change your domain to Cloudflare’s nameservers

Let’s run through each step in a little more detail…

Step 1: Create Your Cloudflare Account

To get started, head on over to Cloudflare and create a new account:

how to sign up at cloudflare

Step 2: Add Your Website To Cloudflare

Once you’ve created an account, Cloudflare will prompt you to Add a website right away. To do that, just paste your domain name into the box and click Scan DNS Records:

add website to cloudflare

Now, you get to watch a short explainer video while Cloudflare scans your site’s DNS records. Once the process finishes, click Continue.

Step 3: Confirm DNS Records And Modify If Needed

On the next page, you can choose which DNS records will be routed through Cloudflare and which will bypass Cloudflare’s network.

You don’t necessarily need to do anything in this interface.

In fact, the only thing that you absolutely need to verify is that you see the orange icon next to the record for your actual domain name:

verify dns records

If you’re a beginner, you can usually stop right now. But depending on your website’s setup, you might also want to verify that:

  • You see the MX records for your email (if applicable). Cloudflare does not route MX records through its network.
  • Any subdomains that you use are either included or excluded from Cloudflare (according to your desired configuration).

Once you’ve configured everything, click the Continue button.

Step 4: Choose Your Plan

On the next page, Cloudflare will try to upsell you to its paid plans. For now, you can just go ahead and choose the Free Website option:

choose cloudflare plan

I’ll discuss some of the reasons to upgrade to Pro later on.

Step 5: Change Nameservers to Cloudflare

At this point, you’re ready to switch your nameservers over to Cloudflare. Head to wherever you registered your domain name and update the nameservers to the two values provided by Cloudflare:

change nameservers to cloudflare

If you’re not sure how to do this – I recommend that you consult your domain name registrar’s support documentation, as the process is different for each registrar.

Here’s what it looks like with Namecheap:

how to change dns at namecheap

Once you make the changes at your registrar, head back to Cloudflare and click the Continue button to finish the process.

You may need to wait several hours while your new nameservers propagate:

cloudflare error message

But once your nameservers have propagated, you should see the full Cloudflare dashboard:

cloudflare dashboard

How To Integrate Cloudflare With WordPress

If you’re using WordPress, Cloudflare provides a dedicated plugin that:

  • Lets you configure WordPress-optimized settings with one click
  • Adds WordPress-specific rulesets to the web application firewall (for paid plans)
  • Lets you automatically purge Cloudflare’s cache when you update your content

And the plugin also lets you change Cloudflare settings from inside your WordPress dashboard, rather than needing to use the Cloudflare website.

Step 1: Activate Official WordPress Plugin

To set up the plugin, get started by installing and activating the Cloudflare plugin. Then, go to Settings → Cloudflare in your WordPress dashboard and click the link to sign in:

configure cloudflare wordpress plugin

On the next screen, you’ll need to enter your email address and API key:

enter cloudflare api key

To find your Cloudflare API key:

  • Go to the Cloudflare interface
  • Click on your email address in the top-right corner
  • Select My Profile
  • Scroll to the API Key section
  • Click View API Key next to the Global API Key option

find cloudflare api key

Copy that value and paste it into the API Key box in your WordPress dashboard:

save api key

Step 2: Enable Optimized WordPress Settings

Once you activate your Cloudflare account within the plugin, you’ll see a number of new options in the Cloudflare plugin interface.

One nice thing about the plugin is that it includes an option to Optimize Cloudflare for WordPress. When applied, Cloudflare will make a number of tweaks to your settings to, well…optimize your settings for WordPress. You can view a full list of those changes here.

While you’ll need to further customize things still, applying these settings is a good way to get started:

configure wordpress with cloudflare

If you’re using a caching plugin like WP Rocket, you should also consult the developer’s documentation for potential specific integration settings. For example, WP Rocket will automatically configure things for you if you authenticate your Cloudflare account with the WP Rocket plugin.

3 More Advanced Cloudflare Configuration Options You Should Set Up

While the basic Cloudflare setup process is fairly simple, if you want to optimize your site, you’ll need to configure some additional settings in your Cloudflare dashboard, especially if you’re using WordPress.

Step 1: Configure Cloudflare SSL Settings

Cloudflare gives you multiple options for how you configure your SSL connection:

  • Off – no SSL active. This isn’t recommended
  • Flexible – traffic is secure between your visitor and Cloudflare, but not between Cloudflare and your origin server.
  • Full – secure connection between both your visitor and Cloudflare and Cloudflare and your origin server
  • Full (strict) – the same as Full but with the benefit of authentication

Here’s which option to use:

  • If you’re able to install an SSL/TLS certificate at your host, use one of the Full options (depending on the type of certificate you have).
  • If you’re unable to install an SSL/TLS certificate at your host, use the Flexible option. It still adds some security and gets you the coveted “green padlock”.

To configure your SSL settings, go to the Crypto tab in your Cloudflare dashboard and use the drop-down:

cloudflare ssl

Step 2: Set Up HTTPS And WordPress-Specific Page Rules

Page rules are a helpful feature that let you:

  • Exclude specific URLs from Cloudflare
  • Force HTTPS on all your pages/content

By default, Cloudflare gives you 3 free page rules, though you can add additional page rules starting at $5 per month for 5 rules.

For most WordPress sites, though, 3 page rules are enough to get started. Here’s what you’ll want to use them for:

  • Force HTTPS
  • Exclude wp-admin from Cloudflare and secure
  • Secure wp-login.php

The latter two rules are important to secure sensitive areas of your site and ensure that you don’t experience any issues with the WordPress dashboard.

To set up your page rules, go to the Page Rules tab in your Cloudflare dashboard. Then, click Create Page Rule:

accessing cloudflare page rules

Page Rule #1: Force HTTPS

To force site-wide HTTPS use, create a page rule for http://*yourdomain.com/* like follows:

cloudflare page rule 1

Page Rule #2: Secure wp-admin And Exclude From Cache

Next, create a rule for yourdomain.com/wp-admin* like follows:

cloudflare page rule 2

Page Rule #3: Secure wp-login.php

Finally, create a third page rule for yourdomain.com/wp-login.php* like follows:

cloudflare page rule 3

Here’s a quick recap:

Rule #1:

http://*yourdomain.com/*

Always use HTTPS

Rule #2:

yourdomain.com/wp-login.php*

Security Level: High

Rule #3:

yourdomain.com/wp-admin*

Security Level: High, Cache Level: Bypass, Disable Apps, Disable Performance

all three cloudflare page rules

If you’re willing to purchase additional page rules (starting at $5 per month for 5 page rules), you can also do things like:

  • Set specific cache settings for different URLs or directories (e.g. /wp-content)
  • Manage 301 redirects for pages or for redirecting attempts at XMLRCP.php
  • Lots of other smaller tweaks, like using browser integrity checks to block brute force attempts

Step 3: Consider Using 2-Factor Authentication For Your Cloudflare Account

Because you can manage DNS records directly from your Cloudflare account (as well as a plethora of other sensitive settings), you need to pay serious attention to preventing unauthorized access to your Cloudflare account.

Thankfully, Cloudflare offers optional 2-factor authentication via:

  • Google Auth
  • Authy
  • TOTP

To configure it, go to My Profile and select your desired option:

cloudflare two-factor authentication

Other Helpful Features + Reasons To Consider Cloudflare Pro

Beyond the core features above, Cloudflare has a number of other features that you might want to consider:

  • Always Online – FREE – if your site goes down, this feature serves up a cached version so visitors can still access it. Configure in Caching tab.
  • Rate Limiting – Billed on usage (first 10,000 requests are free) – protect your site by blocking certain IP addresses that fit specified rules. Configure in Firewall.
  • Argo – Billed on usage – delivers responses to users more quickly by using optimized routes across the Cloudflare network.
  • I’m Under Attack Mode – FREE – helps protect your site during a DDoS attempt. Enable in your main dashboard.
  • Web Application Firewall – PAID – includes specific rulesets for WordPress sites. Configure in Firewall.
  • Polish – PAID – automatically optimizes images, including WebP images. Configure in Speed.

If you want access to features like the Web Application Firewall and Polish image optimization, Cloudflare’s paid plans start at $20 per month.

Final Thoughts On Cloudflare For WordPress Sites

Cloudflare offers an easy-to-implement way to both secure and speed up your WordPress website.

You can get started in just a few minutes by adding your site and pointing your nameservers to Cloudflare. After that, you’ll want to make some further tweaks by setting up SSL and page rules, as well as considering whether or not you want access to Cloudflare’s premium settings.

Give it a try and see if it improves your site’s page load times!

Tweet
Pin2
Share1
+1
3 Shares

Filed Under: WordPress

Footer

Follow Along for WordPress Goodies

  • GitHub
  • LinkedIn
  • Twitter

Powered by: WordPress, Genesis, Cloudflare, ServerPilot, and DigitalOcean
Copyright © 2023 Jordon Rupp | Terms of Service