How to Set Up Cloudflare Free for WordPress: DNS, Full (Strict) SSL and Cache Rules

Cloudflare's free plan sits between your WordPress site and its visitors. It serves static files from servers close to each visitor, hides your server's IP address, blocks a lot of bad traffic, and gives you free HTTPS at the edge. Setting it up takes about 30 minutes, plus the time it takes for nameservers to switch over.

Done carelessly, it also causes some of the most common WordPress problems: redirect loops, a broken Elementor editor, email that stops working, and logged-in pages cached for everyone. This guide sets it up in the right order so you avoid all of them.

Quick steps

1. Make sure your site already has a valid SSL certificate on the hosting.
2. Create a free Cloudflare account and add your domain on the Free plan.
3. Check the imported DNS records; keep mail records DNS only (grey cloud).
4. Change the nameservers at your domain registrar.
5. Set SSL/TLS to Full (strict) and turn on Always Use HTTPS.
6. Apply safe speed and security settings; leave Rocket Loader off.
7. Add cache rules, with a bypass for wp-admin and logged-in users.
8. Test the site, the admin area, forms and email.

Before you start

• SSL on the hosting. Install your host's free certificate first (on cPanel that's AutoSSL / Let's Encrypt). Our guide to a free SSL certificate in cPanel covers it. Without it you can't use Full (strict), and Flexible SSL causes redirect loops.
• Access to your domain registrar, such as GoDaddy, Namecheap or Hostinger, where you'll change the nameservers.
• A list of your DNS records. In cPanel, open Zone Editor and export or screenshot every record. You'll compare it with what Cloudflare imports.
• A backup of the site, just in case.

Step 1: Add your site to Cloudflare

1. Sign up at cloudflare.com and choose Add a domain (or Add a site).
2. Enter your root domain, for example yourdomain.com, without www.
3. Choose the Free plan.
4. Cloudflare scans your existing DNS records and imports what it finds.

Step 2: Check the DNS records (don't skip this)

The scan doesn't always find every record. Compare Cloudflare's list with the export from your hosting, line by line. Pasting both lists into a diff tool makes missing records obvious.

Each record has a proxy status:

• Proxied (orange cloud): traffic goes through Cloudflare. Use this for your website: the root domain (@) and www.
• DNS only (grey cloud): Cloudflare just answers the DNS lookup and traffic goes straight to your server.

Set these to DNS only, or things break:

Also check that your SPF, DKIM and DMARC TXT records were imported. If they're missing, your emails start landing in spam. If WordPress emails stop after the move, see WordPress not sending emails.

Step 3: Change the nameservers

Cloudflare gives you two nameservers, for example ada.ns.cloudflare.com and bob.ns.cloudflare.com. Replace your current nameservers with these at the registrar:

• GoDaddy: My Products > Domain > DNS > Nameservers > Change > I'll use my own nameservers.
• Namecheap: Domain List > Manage > Nameservers > Custom DNS.
• Hostinger: Domains > your domain > DNS / Nameservers > Change nameservers.

Remove the old nameservers completely, and turn off DNSSEC at the registrar before switching (you can turn it on again later from Cloudflare). Cloudflare emails you when the domain is active. That often takes under an hour, but can take up to 24 to 48 hours.

From now on, DNS changes are made in Cloudflare, not in cPanel's Zone Editor. Changes in cPanel no longer have any effect.

Step 4: SSL/TLS: use Full (strict)

Go to SSL/TLS > Overview and choose the encryption mode:

Full (strict) needs a valid certificate on your server. Your host's free Let's Encrypt certificate works. If you can't get one, create a free Cloudflare Origin CA certificate under SSL/TLS > Origin Server: it's valid for up to 15 years, and you install it in cPanel under SSL/TLS > Manage SSL sites. It's trusted only by Cloudflare, so the orange cloud must stay on for those hostnames.

Then, under SSL/TLS > Edge Certificates, turn on:

• Always Use HTTPS: redirects every HTTP request to HTTPS.
• Automatic HTTPS Rewrites: fixes some mixed content warnings.
• Minimum TLS version: 1.2.

Keep only one place that forces HTTPS. If your host, an .htaccess rule and a plugin like Really Simple SSL all redirect too, you can end up in a loop. The full fix for that is in WordPress login redirect loop.

Step 5: Speed settings that are safe for WordPress

• Brotli compression: on (on by default for most zones).
• Rocket Loader: off. It rewrites how JavaScript loads and is a known cause of the Elementor editor not loading, broken sliders and jQuery errors. Elementor's own help centre points to it when the editor gets stuck.
• Auto Minify: no longer exists; Cloudflare retired it in 2024. Minify with your caching plugin instead.
• Early Hints: fine to turn on.
• Polish and Mirage (image optimisation) are paid features. On the free plan, convert images to WebP yourself; see how to convert website images to WebP.

Step 6: Security settings worth turning on

• Bot Fight Mode: blocks many bad bots. If it blocks something you need (a payment callback, uptime monitor or app), add a skip rule for that path or turn it off.
• Security level / challenge: leave the default. "I'm Under Attack" mode is only for an actual attack.
• WAF custom rule for the login page: on the free plan you can add a custom rule that shows a Managed Challenge for /wp-login.php and /xmlrpc.php when the visitor's country isn't one you expect. It stops most brute-force bots before they reach WordPress.

Show visitors' real IP addresses in WordPress

Behind Cloudflare, your server sees Cloudflare's IP for every visitor unless it's told otherwise. Security plugins like Wordfence then block or log the wrong IPs. Most hosts handle this at server level already. If not, install the official Cloudflare plugin, or in Wordfence set How does Wordfence get IPs to use the CF-Connecting-IP header.

Step 7: Cache rules

By default Cloudflare caches static files (images, CSS, JavaScript, fonts) but not HTML pages. That alone helps. Caching HTML makes pages much faster, but it must never cache logged-in users, the admin area, or carts.

Go to Caching > Cache Rules and create rules in this order.

Rule 1: Bypass cache for admin and logged-in users

Match any of these:

• URI path contains /wp-admin
• URI path contains /wp-login.php
• Cookie contains wordpress_logged_in
• Cookie contains wp-postpass (password-protected posts)
• For WooCommerce: URI path contains /cart, /checkout or /my-account, or cookie contains woocommerce_items_in_cart

Action: Bypass cache. If you renamed your login page with a plugin like WPS Hide Login, add that path as well.

Rule 2 (optional): Cache HTML for everyone else

Match: hostname equals your domain. Action: Eligible for cache, with an Edge TTL of a few hours. Rule 1 must come first.

The catch: when you edit a page, Cloudflare keeps serving the old copy until the cache expires or you purge it. If you don't want to purge by hand, either use a plugin that purges automatically (such as Super Page Cache, which manages Cloudflare cache rules for you), use Cloudflare's paid APO for WordPress, or skip Rule 2 and let your host's page cache handle HTML.

Browser cache

Under Caching > Configuration, Browser Cache TTL set to "Respect existing headers" is usually right if your caching plugin sets headers. More on cache headers in website speed optimization.

When you update the site

• Caching > Configuration > Purge Cache > Purge Everything after a big design change.
• Development Mode turns off Cloudflare caching for 3 hours while you work.

Step 8: Test everything

• Open the site in a private window: does it load over HTTPS with no warnings?
• Log in to wp-admin, edit and save a page, and open the Elementor (or block) editor.
• Submit the contact form and check the email arrives.
• Check webmail and email clients still connect.
• In DevTools > Network, open an image or page and look for the response header cf-cache-status: HIT means served from Cloudflare's cache, DYNAMIC means not cached (correct for HTML unless you added Rule 2), BYPASS means your bypass rule matched.

Common problems after adding Cloudflare

Frequently asked questions

Is Cloudflare free for WordPress?

Yes. The free plan includes DNS, the CDN for static files, free edge SSL, basic DDoS protection, WAF custom rules and cache rules. Image optimisation (Polish) and APO for WordPress are paid add-ons.

Which SSL mode should I use for WordPress on Cloudflare?

Full (strict), with a valid certificate on your hosting. Avoid Flexible: it causes redirect loops and leaves the connection to your server unencrypted.

Should email DNS records be proxied?

No. Set mail, webmail and the MX target to DNS only (grey cloud). Cloudflare's free proxy only handles web traffic.

Does Cloudflare cache WordPress pages?

Not by default; it caches static files like images, CSS and JavaScript. You can cache HTML with a cache rule, but you must bypass wp-admin, logged-in users and cart pages, and purge the cache after updates.

Should I turn on Rocket Loader for WordPress?

Usually not. It often breaks page builders like Elementor, sliders and other JavaScript. Use your caching plugin's JavaScript delay options instead, and test them.

How long does it take for Cloudflare to become active?

Often under an hour after changing nameservers, but it can take up to 24 to 48 hours.