Cloudflare Setup: DNS, SSL and Caching

01What Is Cloudflare Used For?

Cloudflare is a reverse proxy and a global network that sits between your domain and your server. When a visitor reaches your site, the request first goes to the Cloudflare data center closest to them; static files are served from there and the remaining requests are forwarded to your server. That gains you speed and hides your server’s real IP address.

In short, Cloudflare does three jobs in one place: DNS management, caching using the content delivery network logic we explained in the what is a CDN article, and a security layer against DDoS and malicious traffic. The free plan is enough for most small and medium-sized sites; paid plans add features such as advanced security rules and image optimization.

An important note: Cloudflare does not fix a slow server or a bloated page on its own. The real gain comes when the page itself is optimized too; so think of Cloudflare as part of a speed and performance management effort.

02Before You Start

Because you will be changing how the domain is managed during setup, gathering a few pieces of information beforehand prevents downtime. The most common problem is mail stopping because email records were not carried over.

• Login details for the panel of the company you bought the domain from (to change nameservers).
• A full list of existing DNS records: A, AAAA, CNAME, MX records, TXT (SPF, DKIM, verification codes).
• Your server’s IP address and whether the site has a valid SSL certificate.
• If DNSSEC is enabled on the domain, you need to turn DNSSEC off at the registrar before the switch; otherwise the domain may not resolve.

03Adding Your Domain to Cloudflare

After you create an account in the Cloudflare dashboard, the add-site wizard guides you step by step. These steps are independent of your operating system; everything is done in the browser.

1. Click the add-site option in the dashboard and enter your domain without www (example.com).
2. Choose the plan; the Free plan is enough to start.
3. Compare the DNS records Cloudflare found one by one with your old list, and add any missing ones manually.
4. Cloudflare gives you two nameserver addresses. In your domain registrar’s panel, delete the existing nameservers and enter these two addresses.
5. When Cloudflare detects the change, the domain becomes active and you are notified by email.

Orange Cloud or Grey Cloud?

Each record has a cloud icon next to it. The orange cloud (Proxied) means traffic passes through Cloudflare, with caching and security active. The grey cloud (DNS only) means Cloudflare only answers DNS queries and doesn’t touch the traffic.

Make the A and www CNAME records used for the website orange. Leave records pointing to the mail server, and subdomains you use for FTP or SSH, grey; MX records can’t be proxied anyway.

04Choosing the Right SSL Mode

The SSL/TLS setting determines how the connection between the visitor and Cloudflare, and between Cloudflare and your server, is encrypted. Choosing the wrong mode is the step that produces the most errors in a Cloudflare setup.

If your server has a valid certificate, always use Full (strict). If you don’t have a certificate, you can install the free Origin CA certificate that Cloudflare offers on the server, or get a certificate with Let’s Encrypt; you can find the steps in the SSL certificate installation guide.

Finish the HTTPS Settings

• Redirect all HTTP requests to HTTPS with Always Use HTTPS.
• The Automatic HTTPS Rewrites option reduces mixed-content warnings (images and scripts called over http) on the page.
• Turn on HSTS only if you are sure all your subdomains work flawlessly over HTTPS; it is hard to undo.

05How to Configure Caching

By default, Cloudflare caches only static files such as images, CSS, JavaScript and fonts; it does not cache HTML pages. This is a safe start, because accidentally caching dynamic pages causes serious problems in carts and member areas.

For a static site or pages that rarely change, you can cache HTML too with Cache Rules. Always leave URLs such as the admin panel, cart, checkout and account pages out of the cache. If you use an e-commerce infrastructure, make this distinction together with your developer.

• Browser Cache TTL: determines how long the browser keeps a file; if you use versions in file names, you can keep it long.
• Development Mode: temporarily disables the cache while you make design changes.
• Purge Cache: clears the whole cache or only specific URLs after an update.
• Brotli compression and HTTP/3 options can be turned on under the speed settings.

06Basic Security Settings

Even the free plan has a few useful security settings. When you turn them on, monitor security events in the dashboard for the first few days to make sure you aren’t blocking real visitors.

If you are under attack, Under Attack Mode applies a short browser check to every visitor; turn it off when the problem passes, otherwise the user experience and bot-dependent integrations are affected.

• Slow down known bad bots with Bot Fight Mode.
• Write a country- or IP-based access rule for your admin panel address.
• Turn on two-factor authentication on your account; if the Cloudflare account is taken over, your whole domain is taken over.
• Allowing web traffic on the server side only from Cloudflare IP ranges prevents your real IP from being targeted directly.

07Commands to Verify the Setup

Propagation of the nameserver change usually takes a few hours, and rarely can stretch to 24–48 hours. You can check the status yourself with the commands below. nslookup comes built in on Windows, and dig and curl on macOS and Linux.

nslookup -type=NS ornek.com
curl.exe -sI https://ornek.com

dig +short NS ornek.com
curl -sI https://ornek.com | grep -i -E 'server|cf-cache-status'

How to Read the Output

In the NS query you should see the two addresses Cloudflare gave you. In the HTTP headers, the line server: cloudflare shows that traffic passes through Cloudflare, and the cf-cache-status value shows whether the file came from the cache: HIT means from the cache, MISS means from the server.

08Common Errors and Fixes

Cloudflare error pages tell you where the problem is by their codes. Read the code before you panic; most of the time the problem is on the server side.