Cloudflare can add DNS management, HTTPS, CDN delivery, caching controls, and network-level protection to a WordPress website without requiring you to change your hosting provider. The difficult part is knowing which settings to enable and which ones can create problems.

This guide shows you how to configure Cloudflare for WordPress from scratch using the free plan. You will learn how to connect your domain, configure DNS, choose the correct SSL mode, force HTTPS, handle caching, install the Cloudflare WordPress plugin, review security settings, and test the finished setup.

The goal is a simple configuration that works with a typical WordPress blog without adding unnecessary complexity.

What Is Cloudflare?

Cloudflare is a network service that can sit between your visitors and your WordPress hosting server.

When your domain uses Cloudflare as its authoritative DNS provider and your web records are proxied, visitor traffic can pass through Cloudflare’s network before reaching your origin server. Cloudflare can then provide services such as CDN delivery, SSL/TLS, DDoS protection, caching, and traffic filtering.

Cloudflare’s current free plan includes DNS, CDN, universal SSL, unmetered DDoS protection, and a managed ruleset.

For WordPress, this creates a useful separation between your website application and the network layer.

Your hosting provider still runs:

• WordPress

• PHP

• MySQL or MariaDB

• Your themes and plugins

• Your website files

• Your database

Cloudflare does not replace your hosting.

It works alongside it.

A simplified request can look like this:

Visitor → Cloudflare → WordPress hosting → WordPress

This distinction matters because Cloudflare cannot fix every performance problem. A slow database query, overloaded server, large images, inefficient plugins, or poorly optimized JavaScript can still affect your website.

Is Cloudflare for WordPress free?

Yes, Cloudflare offers a free plan at $0 per month. Its current plan information lists CDN, Universal SSL, DNS, and unmetered DDoS protection among the included features.

For a normal WordPress blog, the free plan can provide a strong starting point.

You can use Cloudflare without moving your hosting.

You also do not have to transfer your domain registration to Cloudflare. With a standard full DNS setup, you point your domain’s authoritative nameservers to Cloudflare while keeping your registrar and hosting provider.

There is one important distinction.

Cloudflare Automatic Platform Optimization, or APO, is a separate feature. Cloudflare currently lists APO at $5 per month for free plan customers. It is included with certain paid plans.

This guide focuses on the basic free configuration.

You can consider APO later if you specifically need edge caching for WordPress HTML.

What You Need Before Setting Up Cloudflare

Prepare the following before you start Cloudflare for WordPress:

• A registered domain

• A working WordPress website

• Access to your domain registrar

• Access to your WordPress dashboard

• Access to your hosting account

• Your current DNS records

The DNS records deserve particular attention.

If you use email with your domain, you need to preserve your MX, SPF, DKIM, and DMARC records where applicable.

Cloudflare warns that an incomplete or incorrect DNS configuration can make your domain unreachable. Its current setup documentation specifically recommends reviewing DNS records before changing nameservers.

How to Set Up Cloudflare for WordPress

The setup below uses Cloudflare’s standard full DNS configuration, which is available on the free plan.

Step 1: Create Your Cloudflare Account

Go to Cloudflare and create an account.

After signing in:

1. Open the Cloudflare dashboard.
2. Choose the option to add a website.
3. Enter your domain name.
4. Select the free plan.
5. Let Cloudflare scan your existing DNS records.

Do not change your nameservers immediately.

First, review the DNS records Cloudflare discovered.

Cloudflare’s quick scan can’t guarantee that it will detect all the existing records. You should therefore compare the imported records with your existing DNS configuration.

Pay particular attention to the following:

• Your main A record

• AAAA records if your hosting uses IPv6

• www CNAME records

• MX records

• SPF records

• DKIM records

• DMARC records

• Verification records for third-party services

Step 2: Add Your WordPress Domain

Cloudflare will ask you to enter your domain.

Enter the domain without adding unnecessary paths.

For example:

yourdomain.com

Cloudflare will then create a DNS zone for your domain.

The free plan uses Cloudflare as the authoritative DNS provider through a full setup. This means your registrar will eventually point the domain’s nameservers to Cloudflare.

Step 3: Review Your DNS Records

This is the most important part of the initial configuration.

Your website needs DNS records that point visitors to the correct destination.

A typical WordPress setup may contain something similar to:

These are examples only.

Do not copy the values from this table into your DNS dashboard.

Use the values supplied by your hosting and email providers.

Cloudflare distinguishes between proxied and DNS only records.

A proxied record uses the orange cloud. Web traffic passes through Cloudflare.

A DNS only record uses the gray cloud. Cloudflare provides the DNS response but does not proxy the traffic.

For a normal website A or CNAME record, you will usually want Cloudflare proxying enabled.

For mail records such as MX records, use DNS only.

A simple rule is

Web traffic → Proxied

Email traffic → DNS only

Step 4: Change Your Domain Nameservers

Once your DNS records are correct, Cloudflare will provide two assigned nameservers.

They will look similar to:

example.ns.cloudflare.com

example2.ns.cloudflare.com

Do not use these example names.

Cloudflare assigns specific nameservers to your domain.

Now log in to your domain registrar.

Find the Nameservers or DNS delegation section.

Replace both of your current nameservers with Cloudflare’s two nameservers.

Save the changes.

Cloudflare will then become the authoritative DNS provider for your domain.

DNS propagation can take time.

During this stage, avoid making several other changes at the same time.

First, confirm that your domain becomes active in Cloudflare and that the website continues to load.

Step 5: Configure SSL/TLS

SSL/TLS protects the connection between your visitors and your website.

With Cloudflare, there are two connections to consider:

Visitor → Cloudflare

Cloudflare → Origin server

For a secure WordPress configuration, both connections should use HTTPS.

Open:

Cloudflare Dashboard → SSL/TLS → Overview

For most WordPress websites with a valid SSL certificate on the hosting server, select:

Full (strict)

Cloudflare recommends Full (strict) whenever possible. The origin certificate must be unexpired, trusted by a public certificate authority or Cloudflare Origin CA, and match the requested hostname.

If your hosting provider already supplies a valid SSL certificate, Full (strict) is usually the most appropriate setting.

Cloudflare also provides free Universal SSL certificates for activated domains on its network.

Do not switch to Full (strict) without checking that your hosting server supports HTTPS on port 443.

An incorrect origin certificate can result in a 526 error.

Step 6: Enable HTTPS

After confirming that HTTPS works correctly, redirect visitors from HTTP to HTTPS.

In Cloudflare, open:

SSL/TLS → Edge Certificates

Then enable:

Always Use HTTPS

Cloudflare currently provides this feature on the free plan. It redirects visitor requests from HTTP to HTTPS.

Before enabling it, test:

If the HTTPS version loads correctly, enable the redirect.

You can also consider automatic HTTPS rewrite if your website still contains HTTP references that cause mixed-content problems. Cloudflare recommends checking existing origin redirects before enforcing HTTPS to avoid redirect loops.

A common redirect loop looks like this:

Cloudflare sends an HTTPS request to the origin.

Origin redirects HTTPS back to HTTP.

Cloudflare redirects HTTP back to HTTPS.

The cycle continues.

Cloudflare documents this as a common cause of redirect errors when HTTPS redirects are configured incorrectly.

Step 7: Configure Cloudflare Caching

Caching is where many WordPress Cloudflare configurations become unnecessarily complicated.

Start simple.

Cloudflare can cache eligible static resources such as images, CSS, and JavaScript. WordPress pages can also involve dynamic content that shouldn’t be treated like a static file.

Avoid creating an aggressive Cache Everything rule simply because it appears to offer better performance.

Dynamic WordPress areas may include:

• WordPress administration

• Login pages

• Shopping carts

• Checkout pages

• Account pages

• Personalized content

• Membership areas

• Other authenticated pages

Cloudflare’s current Cache Rules system allows you to control what is eligible for caching and how long content is cached. Cache Rules require the relevant DNS record to be proxied through Cloudflare.

For a normal WordPress blog, start with the default behavior.

Only create custom cache rules when you have a specific reason.

This makes troubleshooting much easier.

Step 8: Install the Cloudflare WordPress Plugin

Cloudflare provides an official WordPress plugin.

You can find it through:

WordPress Dashboard → Plugins → Add New

Search for:

Cloudflare

The current WordPress.org listing identifies the plugin as being published by Cloudflare. The plugin is actively maintained, and its current listing shows recent releases and WordPress compatibility information.

Install and activate the official plugin.

After authentication, review the available settings.

One particularly useful feature is Automatic Cache Management.

When enabled, the plugin can purge related Cloudflare cache URLs when you add, edit, or delete WordPress posts, pages, attachments, or comments. It can also clear the cache after theme changes and customizer changes.

This can reduce the chance of visitors seeing an outdated cached version of recently changed content.

You don’t need to activate every performance option available.

Keep your setup predictable.

Step 9: Review Cloudflare Security Settings

Cloudflare adds a network security layer in front of your website.

The free plan currently includes unmetered DDoS protection and a managed ruleset.

For a basic WordPress blog, start with the default security configuration.

Monitor Cloudflare’s security events before creating aggressive custom rules.

If legitimate visitors receive challenges or blocks, inspect the event and identify which rule caused it.

Cloudflare should complement your WordPress security practices.

Your WordPress security setup should still include:

• Strong administrator passwords

• Regular WordPress updates

• Updated plugins and themes

• Limited administrator accounts

• Reliable backups

• Secure hosting

• Two-factor authentication where appropriate

Cloudflare does not make outdated WordPress plugins safe.

Step 10: Test Your WordPress Website

Do not consider the configuration finished simply because the homepage opens.

Test the important parts of your website.

Check:

• Homepage

• Blog posts

• Categories

• Images

• CSS

• JavaScript

• Contact forms

• Search

• Login

• WordPress dashboard

• Comments if enabled

• Mobile layout

• www and non-www behavior

Also test both:

http://yourdomain.com

and

The HTTP version should redirect correctly to HTTPS after you enable Always Use HTTPS.

Also, test your website in a private browser window.

This helps reduce confusion caused by your existing browser cache.

What About Cloudflare APO?

Automatic Platform Optimization, or APO, is an optional Cloudflare feature designed specifically for WordPress.

The main difference is that APO can cache WordPress HTML at Cloudflare’s edge rather than focusing primarily on static assets.

Cloudflare describes APO as a WordPress optimization feature that caches HTML and automatically purges updated content.

This can be useful when you want more WordPress content delivered directly from Cloudflare’s edge network.

However, APO isn’t required for the basic Cloudflare setup.

Cloudflare currently lists APO as a $5 monthly add-on for Free plan customers.

For this reason, the free setup in this guide does not depend on APO.

Start with:

DNS

SSL/TLS

HTTPS

CDN

Basic caching

Security

Then measure your website.

Consider APO only if your site has a clear use case for edge HTML caching.

Common Cloudflare for WordPress Problems

1. Too Many Redirects

A redirect loop usually indicates conflicting HTTPS rules.

Check:

• Cloudflare SSL/TLS mode

• WordPress Site Address

• WordPress URL

• Hosting SSL certificate

• Server redirects

• Redirect plugins

• Cloudflare HTTPS settings

Cloudflare specifically documents redirect loops that occur when the origin redirects HTTPS requests back to HTTP.

2. Your Website Shows Old Content

If you update an article but still see the previous version, several caching layers may be involved.

Check:

• Browser cache

• WordPress cache

• Hosting cache

• Cloudflare cache

The Cloudflare WordPress plugin’s Automatic Cache Management can purge relevant URLs when WordPress content changes.

If necessary, purge the relevant cache and test again.

3. Images or CSS Stop Loading

Open your browser’s developer tools and check the Console and Network tabs.

Look for:

• Mixed-content warnings

• 404 errors

• Blocked resources

• Incorrect URLs

• Plugin conflicts

• JavaScript errors

If the problem appeared immediately after enabling HTTPS, investigate HTTP resources first.

4. WordPress Admin Behaves Strangely

Do not cache authenticated WordPress areas as if they were public pages.

If you have created custom Cache Rules, review them.

A custom rule that caches everything can create problems for dynamic applications.

Cloudflare provides Cache Rules specifically so you can control cache behavior for different requests.

5. Multiple Caching Systems Conflict

WordPress websites often use several layers:

Browser cache

WordPress caching plugin

Hosting cache

Cloudflare cache

Edge HTML cache

These systems can work together, but they can also make troubleshooting difficult.

If you enable several systems that modify HTML, CSS, or JavaScript, test them carefully.

For APO specifically, Cloudflare’s documentation highlights stale responses from existing cache plugins as a potential reason for plugin detection or caching issues.

A lean WordPress setup should avoid overlapping optimization features unless you have tested their interactions.

Recommended Free Cloudflare Settings

For a typical WordPress blog, use this as a starting configuration:

This configuration gives you a controlled starting point without requiring complicated Cloudflare rules.

Cloudflare for WordPress Checklist

Use this checklist before considering your setup complete.

Create your Cloudflare account

Add your domain

Review imported DNS records

Verify the A record

Verify the www record

Check MX records

Check SPF, DKIM, and DMARC records if applicable

Change your nameservers at the registrar

Confirm the domain becomes active in Cloudflare

Check the Universal SSL certificate

Configure Full (strict) SSL/TLS

Test HTTPS

Enable Always Use HTTPS

Check for mixed content

Install the official Cloudflare WordPress plugin if needed

Enable Automatic Cache Management if appropriate

Review security settings

Avoid unnecessary Cache Rules

Test WordPress login

Test contact forms

Test images and CSS

Test JavaScript

Test mobile pages

Clear caches after major configuration changes

Test page performance after Cloudflare is active

Final Thoughts

Cloudflare for WordPress doesn’t require a complicated configuration.

Start with the fundamentals.

Move your DNS to Cloudflare. Verify every important DNS record. Configure Full (strict) SSL/TLS when your origin supports it. Enable HTTPS. Keep caching conservative. Install the official WordPress plugin if useful for your setup. Then test the website.

Start by moving your DNS to Cloudflare. Then verify every important DNS record. Next, configure Full (strict) SSL/TLS when your origin supports it. Enable HTTPS, keep caching conservative, and install the official WordPress plugin if its features suit your setup. Then test the website.

Don’t consider Cloudflare for WordPress optimization as a replacement.

Your hosting server still matters. Your theme matters. Your plugins matter. Your images, database, CSS, JavaScript, and caching strategy all affect performance.

A clean configuration makes the entire WordPress stack easier to understand and troubleshoot.

Once the basic setup works, measure your website before making further changes. If you later need edge caching for WordPress HTML, you can evaluate Cloudflare APO separately.

For most WordPress blogs, that is a better starting point than enabling every Cloudflare feature at once.

FAQs