Cloudflare can improve DNS performance, reduce unwanted traffic and cache static assets, but an aggressive configuration can also cause redirect loops, stale pages or broken WooCommerce sessions. This guide explains a safe, staged Cloudflare WordPress setup.
Before changing anything
- Confirm the site works correctly without Cloudflare.
- Take a full file and database backup.
- Record current DNS records and mail settings.
- Make sure WordPress Address and Site Address use HTTPS.
Step 1: add the domain and review DNS
Add your domain to Cloudflare, then compare every imported record with the DNS zone at your current provider. Website records can usually be proxied. Mail hostnames and records used by third-party services often need DNS-only mode. Never delete MX, SPF, DKIM or DMARC records simply because they are not website records.
Step 2: change nameservers
Cloudflare provides two authoritative nameservers. Replace the current nameservers at your domain registrar, then wait for activation. Keep the previous DNS record list until the new zone is verified. If you need a domain, SiteChai Domain Registration provides domain-management access and support.
Step 3: choose the correct SSL mode
Use Full (strict) when the origin server has a valid certificate. Avoid Flexible mode for a normal WordPress HTTPS site because it can create insecure origin traffic and redirect problems. Confirm that both the root domain and www version behave consistently.
Step 4: start with conservative caching
Cloudflare caches common static file types by default. Do not immediately cache all HTML. WordPress login, admin, cart, checkout and account pages must remain dynamic. Cloudflare’s official documentation explains Cache Rules and cookie-based bypasses for logged-in visitors.
Step 5: configure WordPress integration
The official Cloudflare plugin can purge relevant cache when content changes and supports Automatic Cache Management. Cloudflare advises testing interactions with other caching plugins carefully; stacking multiple full-page caching systems can create unexpected results.
Pages that should bypass cache
- /wp-admin/ and /wp-login.php
- WooCommerce cart, checkout and account pages
- Preview URLs
- Pages personalized by login or session cookies
Troubleshooting common problems
Too many redirects
Check SSL mode, WordPress HTTPS settings and origin redirects. Do not add multiple rules that force conflicting hostnames.
Changes are not visible
Purge the relevant Cloudflare cache, then clear the WordPress/server cache. Test in a private window.
Real visitor IPs are missing
Ensure the server is configured to restore visitor IPs from trusted Cloudflare headers. Your hosting provider can help.
Frequently asked questions
Is Cloudflare free?
A free plan exists and covers many DNS, CDN and security basics; optional features and plan details can change, so check Cloudflare’s current plan page.
Do I still need hosting?
Yes. Cloudflare normally sits in front of your origin server; it does not replace WordPress hosting.
Should I use APO?
APO can cache dynamic WordPress content at the edge. Test it on a staging site first, especially with ecommerce or membership features.
If you want a managed starting point, review SiteChai WordPress Hosting or contact support before changing production DNS.