Cloudflare sits between your visitors and your hosting server, offering CDN caching, security filtering and DNS management in one free service. Setup is simple in outline but has a few steps that, done wrong, cause confusing downtime.

Step 1: Create an Account and Add Your Domain

Sign up at Cloudflare, add your domain, and let it scan your existing DNS records automatically. Verify every record was captured correctly before proceeding — missed records (particularly MX records for email) are the most common cause of post-migration problems.

Step 2: Update Your Nameservers

Cloudflare provides two nameserver addresses to set at your domain registrar, replacing your current ones. Propagation typically completes within a few hours, occasionally up to 24-48 hours globally.

Step 3: Verify Email Still Works

This is the step most often skipped, and the most damaging when missed. Confirm your MX records transferred correctly and that Cloudflare's proxy (the orange cloud icon) is disabled for mail-related records — a proxied MX record will break email delivery entirely.

Step 4: Configure SSL

Set the SSL/TLS mode to "Full" or "Full (strict)" if your origin server already has a valid SSL certificate — "Flexible" mode, while easier, can cause redirect loops on WordPress sites with forced HTTPS.

A Real Troubleshooting Scenario: The Redirect Loop

A common support ticket: a site was working fine, then immediately after enabling Cloudflare it started showing "too many redirects" in every browser. The cause, nearly every time, is the SSL mode mismatch just described — the origin server (via a WordPress "force HTTPS" plugin or setting) redirects any HTTP request to HTTPS, but Cloudflare's "Flexible" mode connects to that same origin over plain HTTP, so the origin immediately redirects back to HTTPS, which Cloudflare again serves over HTTP, looping indefinitely. The fix is a single setting change: switch SSL/TLS mode from Flexible to Full (or Full strict, if the origin certificate is valid and trusted), which tells Cloudflare to connect to the origin over HTTPS too, breaking the loop immediately with no code or plugin changes needed.

Step 5: Enable Caching and Performance Features

  • Turn on Auto Minify for CSS, JavaScript and HTML.
  • Enable Brotli compression if available on your plan tier.
  • Set a sensible browser cache TTL for static assets.

Step 6: Basic Security Configuration

  • Enable the Web Application Firewall (WAF) on the free tier's default rule set.
  • Set an appropriate Security Level based on how much bot traffic your site experiences.
  • Consider enabling Bot Fight Mode for basic automated-traffic mitigation.

Page Rules Worth Setting Up on the Free Tier

The free tier includes a small number of Page Rules, and a few are worth using on almost every site: a rule forcing http:// to https:// site-wide removes any dependency on the origin server handling that redirect itself; a "Cache Everything" rule scoped to a static-assets path (like /wp-content/uploads/*) extends caching beyond Cloudflare's defaults for content that rarely changes; and a rule bypassing cache entirely for admin and login paths (/wp-admin/*, /wp-login.php) prevents Cloudflare from ever serving a stale, cached version of pages that must always be current.

Common Mistakes to Avoid

  • Proxying MX records (breaks email) — always keep DNS-only for mail records.
  • Using "Flexible" SSL mode with a site that forces HTTPS, causing redirect loops.
  • Forgetting to whitelist your own IP if aggressive security settings start blocking legitimate admin access.

Frequently Asked Questions

Will Cloudflare break my existing email hosting?

Not if MX records are correctly imported and left unproxied — always double check this specific setting during setup.

Is Cloudflare's free tier sufficient for a small business?

Yes, for the vast majority of small and mid-size Nepali business websites, the free tier covers CDN, basic security and SSL adequately.

Can Cloudflare slow down my site if misconfigured?

In rare cases — overly aggressive caching of dynamic content, or a Page Rule that conflicts with your app's session handling, can cause odd behavior. Testing thoroughly after each configuration change catches this quickly.

Does enabling Cloudflare change my server's actual visitor IP logs?

Yes, without additional configuration, your origin server sees Cloudflare's IPs rather than the visitor's real IP — most hosts, WebsNP included, can configure the real visitor IP to be restored in logs and analytics via Cloudflare's provided IP-restoration module.

Need help setting up Cloudflare correctly? See our hosting plans or ask our team for setup assistance.