Three in the morning. My phone vibrates. A client's e-commerce site is throwing Error 526, the campaign launches in six hours, and the owner is sending voice notes on WhatsApp like there's no tomorrow. The fix? Origin certificate expired, and Cloudflare is in Full (Strict) mode. Five minute job. But if you don't know that five minute job, you'll spend the night on it.
I've been using Cloudflare for years and I still discover a new corner of it every week. This isn't a regurgitated tutorial. These are the things I learned by setting it up, breaking it, and unbreaking it.
What Cloudflare actually does
People sell Cloudflare as "a CDN." That's the visible tip. Cloudflare is a reverse proxy. A user hits your domain, the request lands on a Cloudflare edge server first, then it goes to your origin (if it has to). The side effects of that simple architecture are massive: caching, DDoS protection, WAF, SSL termination, bot management, image optimization, even running JavaScript at the edge with Workers.
So you're not just speeding up static files. You're inserting a layer that can filter, transform, and log all your traffic. On the free plan, no less.
CDN in plain words
A user in Istanbul pings your server in Frankfurt. RTT around 50ms. Add TLS handshake, TCP, and time to first byte and the page takes 1.2 seconds to load. Plug in Cloudflare and that request hits Istanbul edge. RTT 8ms. If the asset is cached, it never touches your origin. Page loads in under 200ms.
Cloudflare has POPs in over 330 cities. That's why your server can sit in New York while your Turkish users effectively get served from a box in Istanbul.
Setup: handing over DNS
You connect Cloudflare to a site in two ways: full DNS handover or CNAME setup (Business+ only). You're probably doing the full handover because it's free.
Here's the flow:
- Add the domain in Cloudflare. It auto-scans existing DNS. Double check, add anything missing.
- Cloudflare assigns you two nameservers (e.g.
ada.ns.cloudflare.com,kurt.ns.cloudflare.com). - Update your registrar to use those nameservers.
- Propagation takes 5 minutes to 24 hours. Usually 30 minutes.
Most common mistake here: people forget MX, SPF, DKIM records. Email breaks. Before you migrate, take a full screenshot of your existing DNS and re-enter every record manually.
Orange cloud vs grey cloud
Every DNS record in Cloudflare has a cloud icon next to it. Orange = proxied, traffic flows through Cloudflare. Grey = DNS only, traffic goes straight to origin.
Sounds simple. It trips up engineers daily.
If you leave ssh.example.com orange, SSH dies. Cloudflare only proxies HTTP/HTTPS. Same with mail; mail.example.com needs to be grey, and your MX records should point to that grey A record. Otherwise email goes silent and you're chasing ghosts in spam folders.
Rule of thumb: web traffic records get the orange cloud, everything else stays grey.
SSL/TLS modes: why Flexible is dangerous
Cloudflare offers four SSL modes: Off, Flexible, Full, Full (Strict). New users grab Flexible and call it a day. They shouldn't.
- Flexible: encrypted between user and Cloudflare, plaintext between Cloudflare and your origin. The padlock looks fine in the browser but you're wide open to MITM.
- Full: encrypted both ways, but origin certificate is not validated. Self-signed works.
- Full (Strict): both legs HTTPS and origin cert must be valid. This is where production should live.
If you don't have a cert on origin, Cloudflare gives you a free 15-year Origin CA certificate. Browsers don't trust it (and don't need to), only Cloudflare does. Install it, switch to Full (Strict), enable Always Use HTTPS and Automatic HTTPS Rewrites. Done.
Caching strategy: when to cache HTML
By default, Cloudflare caches static assets (CSS, JS, images, fonts) and skips HTML. HTML is usually dynamic. But for a static blog or marketing page, caching HTML changes everything.
Create a Cache Rule:
If hostname equals "poitim.com"
And URI Path contains "/blog/"
Then Cache eligibility: Eligible for cache
Edge TTL: 1 hour
Browser TTL: 30 minutesNow your blog pages return from edge instantly. We tried this on our own marketing pages and TTFB dropped from 850ms to 40ms. When you're shipping fast and tracking project progress on Poitim, you don't want every reader's first hit to be a cache miss.
One warning: never cache logged-in pages, dashboards, or carts. Add a Bypass Cache on Cookie rule that excludes any session cookie.
Security: WAF, rate limiting, bot fight
The least-used and highest-leverage part of Cloudflare. Even on the free plan you get:
WAF Managed Rules: pre-built protections against OWASP Top 10. Make sure they're enabled. The Cloudflare Free Managed Ruleset is still around if you're not on Pro.
Rate limiting: throttle /api/login to 5 requests per minute per IP and brute force is dead. Two clicks.
Bot Fight Mode: blocks known bot networks and aggressive scrapers. Free. Just whitelist legitimate bots calling your API or you'll break your own integrations.
Security Level: Medium is fine for most sites. High causes captcha rage.
If you're building a SaaS, the dashboard your team uses to manage tasks needs to stay invisible to the open internet. Cloudflare Access does exactly that, free for up to 50 users. SSO, IP allowlists, real zero-trust gating in front of any subdomain.
Workers: code at the edge
Workers are JavaScript/TypeScript functions running on Cloudflare's edge. They run on V8 isolates with no cold start. Compare 5ms warm response to Lambda's 200ms cold start.
What they're good for: A/B tests, header manipulation, geo-routing, light APIs, image transformations, edge auth. A quick example:
export default {
async fetch(request) {
const country = request.cf.country;
if (country === "TR") {
return Response.redirect("https://poitim.com/tr", 302);
}
return fetch(request);
}
}That's geo-redirection without writing a backend. 100k requests/day are free.
R2, D1, Pages
Cloudflare is no longer just a CDN. R2 is S3-compatible object storage with zero egress fees. That's a big deal. Pulling 100GB out of S3 costs you about 9 dollars. R2 charges nothing.
D1 is a SQLite-based edge database. Still feels close to beta but it's solid for small projects.
Pages is the Vercel/Netlify alternative. Git push, auto deploy. Free tier is generous. Frontend on Pages, images on R2, APIs on Workers and your monthly bill can stay at zero.
Mistakes that cost teams a weekend
In rough order, what I've actually seen:
Mistake 1: leaking origin IP. Your A record is orange, but a grey record like cpanel.example.com exposes the real IP. An attacker finds that subdomain and bypasses Cloudflare entirely. Either proxy every public record or remove those IPs.
Mistake 2: caching the wrong pages. A logged-in user seeing someone else's cached homepage is a P0 incident waiting to happen. Always add a cookie-based bypass.
Mistake 3: mixing Page Rules with Cache Rules. Page Rules are the legacy system, Cache Rules are the new one. They run in different orders. On new sites, just use Cache Rules.
Mistake 4: forgetting WebSockets. Your realtime app might run on the free plan but if you push it through Workers, watch the limits. Pro gives you 100 concurrent connections per worker.
Mistake 5: trusting Always Online. It serves stale cache when origin is down. On dynamic sites, it does almost nothing. Don't make it your fallback strategy.
Free, Pro, Business: when do you outgrow it?
The Free plan is unreasonably generous. SSL, unlimited bandwidth, basic WAF, 3 Page Rules. Most blogs and early-stage startups never need more.
Pro (25 dollars/month) adds image polish, mobile optimization, advanced bot protection, 20 Page Rules. Worth it for an e-commerce site or a high-traffic SaaS.
Business (250 dollars/month) gives you custom SSL, prioritized support, 50 Page Rules. Only matters if you have SLA obligations.
Once you're talking Enterprise you have an account manager and you don't need this guide.
Don't rush the setup. Move DNS, wait 24 hours, then push SSL to Full (Strict). Then write cache rules, then tighten WAF and rate limits. Test every step on a staging hostname. The day you flip every record orange in production, half your stack starts misbehaving and you're rolling back in a panic. Been there. Don't go there.