Cloudflare for Business Websites: CDN, SSL and Security Set Up Right

To set up Cloudflare for a business website, add your domain to Cloudflare, check every imported DNS record (especially email), switch your nameservers at the registrar, proxy only the web records, set SSL/TLS to Full (strict), and then add cache and security rules carefully. Done in that order, the switch causes no downtime and email keeps working. Most Cloudflare problems come from three mistakes: missing DNS records, the Flexible SSL mode, and cache rules that cache logged-in pages or the checkout.

This guide is for business owners and in-house teams who want Cloudflare's free CDN, SSL and protection in front of a WordPress, WooCommerce or custom site. Every setting below is checked against Cloudflare's own documentation, listed under Sources.

#What Cloudflare does for a business site

Cloudflare sits between your visitors and your hosting server. When a record is proxied, visitors connect to Cloudflare, and Cloudflare fetches pages from your server (the "origin"). That gives you three things in one place:

• CDN: images, CSS, JavaScript and other static files are served from Cloudflare's network close to the visitor, which takes load off your server.
• SSL: Cloudflare's free Universal SSL certificate covers your root domain and first-level subdomains such as www, and it renews on its own.
• Security: DDoS protection, a web application firewall (WAF), bot challenges and rate limiting, so many bad requests never reach your server.

It also becomes your DNS host, the service that tells the internet where your website and email live. That is the part that needs the most care, because a missing record can take email or a subdomain offline.

#The setup, step by step

The safe order is: get the DNS right first, change nameservers second, and only then touch SSL, cache and security settings.

1. Add the domain. In the Cloudflare dashboard, onboard your root domain (for example example.com) and choose a plan. The Free plan is enough for most small business sites.
2. Review the imported DNS records. Cloudflare scans your current DNS and imports what it finds, but its docs warn the scan may miss some records. Compare the list line by line with your current DNS host. Check the root record, www, every subdomain, and all email records: MX, SPF, DKIM and DMARC.
3. Turn off DNSSEC at your registrar if it is on. Cloudflare warns that changing nameservers while DNSSEC is active can make the domain unreachable.
4. Change the nameservers at your registrar to the two Cloudflare assigns you, exactly as shown. Cloudflare says this can take up to 24 hours; you get an email when the domain is active.
5. Turn DNSSEC back on inside Cloudflare once the domain is active, and add the record it gives you at the registrar.
6. Set SSL/TLS, cache and security as described in the sections below, and test the site, a contact form, a login and, for stores, a full test order.

If you are not sure what each DNS record does, our guide to domain and business email setup explains the email side.

#Proxied or DNS only: which records get the orange cloud

Proxy your website records and leave everything else as DNS only. Cloudflare can only proxy A, AAAA and CNAME records; MX and TXT records are always DNS only.

Two details catch people out. First, if a name has one proxied A record, Cloudflare treats every A or AAAA record on that name as proxied, so give your mail server its own name such as mail.example.com rather than sharing the website's. Second, a DNS-only record publishes your server's real IP address. If your mail runs on the same server as your website, that IP is visible anyway, which is one more reason to run business email with a separate provider.

#SSL/TLS modes: use Full (strict)

Full (strict) is the mode to aim for: traffic is encrypted from the visitor to Cloudflare and from Cloudflare to your server, and Cloudflare checks your server's certificate is valid. Cloudflare's docs strongly recommend Full or Full (strict).

Your server needs its own certificate for Full (strict). Most hosts issue a free Let's Encrypt certificate in the control panel. If your server only ever receives traffic through Cloudflare, you can instead install a free Cloudflare Origin CA certificate. Cloudflare notes that browsers do not trust it directly, so visitors see errors if you ever pause Cloudflare or set that record to DNS only. Cloudflare also does not email you before an Origin CA certificate expires, so note the date.

New domains may start on Cloudflare's automatic SSL/TLS setting, which tests your server and picks the most secure mode it supports. It never lowers the mode on its own. You can switch to a custom setting and pick Full (strict) yourself.

The most common Cloudflare problem is the "too many redirects" loop. It happens in Flexible mode when your server redirects HTTP to HTTPS: Cloudflare asks for the HTTP page, the server says "go to HTTPS", and the loop repeats. The fix is to install a certificate on the server and move to Full (strict). Our guide to free vs paid SSL certificates covers the certificate side and other HTTPS errors.

#Caching without breaking logins or checkout

Cloudflare caches static files by extension (images, CSS, JavaScript, fonts, PDFs and similar) and does not cache HTML or JSON by default. It also skips caching when your server sends a Set-Cookie header or a Cache-Control value such as private or no-store. Out of the box, it is safe for logins and checkout.

The risk starts when you add a rule to cache HTML pages too, often called "cache everything". That can make a site much faster, but if it catches the wrong pages, one customer can be shown another customer's cart or account page. If you add such a rule, always pair it with bypass rules:

The Free plan allows 10 cache rules, enough for a typical business site. Test after each change in a private browser window: log in, add to cart, go to checkout and check the pages are personal to you. Our article on speeding up a WooCommerce store explains why caching the cart and checkout is a common cause of "payment done but order still pending" problems.

#Security features on the free plan

As of November 2026, Cloudflare's plans page lists these on the Free plan, and its docs give the limits. Check the plans page (opens in a new tab) for the current list.

DDoS protection

Unmetered

Custom WAF rules

5

Rate limiting rule

1

Cache rules

10

• DDoS protection: included and unmetered.
• Free Managed Ruleset: a WAF ruleset Cloudflare maintains for common attacks. The larger managed rulesets need a paid plan.
• Custom WAF rules: 5 on Free. Good uses: challenge visitors to /wp-login.php from countries you never do business with, or block requests to xmlrpc.php if you do not use it.
• Rate limiting: 1 rule on Free, matching on path, counting per IP over a fixed 10 seconds. Put it on your login page.
• Bot Fight Mode: free and simple, but Cloudflare warns it may challenge API or mobile app traffic, and it cannot be skipped with WAF rules. If you run a mobile app, payment webhooks or integrations against your site, test them after turning it on, or leave it off.

Pro is listed at USD 20 a month billed yearly and Business at USD 200 a month billed yearly at the time of writing. Most small business sites do not need them. Paid plans make sense when you need more WAF rules, the larger managed rulesets or better bot controls.

#When to get help

You can do this alone if your site is simple and you are comfortable comparing DNS records. Get help when:

• Your email runs on several services (a mail provider, a marketing tool and a transactional sender), each with its own records.
• The site is a store or membership site where a cache mistake could show one customer's data to another.
• You see 52x errors after switching. Our guide to 500, 502 and 504 errors explains what Cloudflare's 520 to 526 codes mean.
• You are moving host at the same time as moving DNS.

Our domain, DNS and Cloudflare setup service covers the move, SSL, cache and security rules, and testing email afterwards. If your speed problem is deeper than caching, see website performance optimisation.