How to Set Up Cloudflare's Free Plan on WordPress, Step by Step: DNS, Nameservers, Full (Strict) SSL, Cache Rules and Troubleshooting

On this page

1. Before you start
2. Step 1: Add your site and choose the free plan
3. Step 2: Check DNS records and proxy status
4. Step 3: Change nameservers at your registrar
5. Step 4: Set SSL/TLS to Full (strict)
6. Step 5: Cache rules, and what never to cache
7. Step 6: APO, cache plugins and who does what
8. Step 7: Restore real visitor IP addresses
9. Step 8: Firewall and bot basics on the free plan
10. Step 9: Test everything
11. Troubleshooting after the switch
12. Quick check: is Cloudflare set up right?
13. When to get help
14. FAQs

To set up Cloudflare's free plan on a WordPress site, add your domain to Cloudflare, check that every DNS record was imported (especially email), change the nameservers at your registrar, set SSL/TLS to Full (strict), and keep logged-in users, wp-admin, cart, checkout and account pages out of any cache. Then restore real visitor IP addresses, add a few firewall rules and test logins, forms and checkout. Done in that order, Cloudflare adds a CDN and basic protection without breaking anything.

When it makes sense for a site, Cloudflare is set up and tested as part of my WordPress speed optimization work, because wrong settings can break logins, checkout or forms. This guide walks through the same steps for a site owner doing it themselves.

If you are still deciding whether you need a CDN at all, read what is a CDN first. Cloudflare renames menus and changes plan features from time to time, so treat the menu names here as correct at the time of writing and check its current documentation as you go.

Before you start

• Export or screenshot your current DNS zone from your host or registrar: every A, CNAME, MX and TXT record.
• Know where your email is hosted: your host, Google Workspace, Microsoft 365 or Zoho. Their MX and TXT records must survive the move.
• Confirm your hosting has a valid SSL certificate, because Full (strict) needs one.
• Check DNSSEC at your registrar. If it is on, turn it off before changing nameservers and re-enable it through Cloudflare afterwards.
• Check your host's own CDN or Cloudflare integration, so you don't end up with two setups fighting each other.
• Take a backup and pick a quiet time of day.

Step 1: Add your site and choose the free plan

Create a Cloudflare account, choose the option to add or onboard a domain, and enter the root domain, such as example.com, not www.example.com. Select the Free plan. Cloudflare scans your existing DNS and shows the records it found. Don't continue past this screen until you have checked them.

Step 2: Check DNS records and proxy status

Compare Cloudflare's list line by line with your export. Scans miss records, especially TXT records and less common subdomains. Each record is either proxied (orange cloud, traffic passes through Cloudflare) or DNS only (grey cloud):

Record	Example	Proxy status
A for the root domain	example.com pointing to 203.0.113.10	Proxied
CNAME for www	www pointing to example.com	Proxied
MX	Your mail provider's servers	Always DNS only
Mail hostnames	mail, webmail, smtp, imap	DNS only
FTP and panel hostnames	ftp, cpanel	DNS only
TXT	SPF, DKIM, DMARC, site verifications	No proxy option
Other subdomains	shop, booking, staging	Proxied if it is a website you control; DNS only for third-party services that ask for it

Missing SPF, DKIM or DMARC records won't stop the website, but they will send your email to spam; see SPF, DKIM and DMARC explained.

Step 3: Change nameservers at your registrar

Cloudflare gives you two nameservers. Whether your domain is with an Indian registrar, a global one or was bought through your hosting company, the process is similar: log in, open the domain's management page, find the nameserver setting, choose custom nameservers, replace the existing ones with Cloudflare's two exactly as shown, and save. .in and .com domains work the same way.

The change can take anything from minutes to a day or two to spread. Cloudflare emails you when the site is active. Leave the old DNS zone at your host untouched until everything works, so you can switch back quickly if needed.

Step 4: Set SSL/TLS to Full (strict)

Cloudflare always encrypts the visitor's connection to Cloudflare. The SSL/TLS mode controls the second leg, from Cloudflare to your hosting:

Mode	Cloudflare to your server	Use it?
Flexible	Plain HTTP	No, it causes redirect loops on WordPress
Full	HTTPS, certificate not checked	Only briefly, while fixing a certificate
Full (strict)	HTTPS with a valid certificate	Yes

Why Flexible loops: WordPress, your host or an SSL plugin redirects HTTP to HTTPS, but Cloudflare keeps requesting the page over HTTP, so the server keeps answering "go to HTTPS" until the browser gives up with ERR_TOO_MANY_REDIRECTS. If you are already stuck, see how to fix ERR_TOO_MANY_REDIRECTS.

Full (strict) works with the free certificate most hosts provide, or with a free Cloudflare Origin CA certificate installed on the server. Origin certificates are trusted only by Cloudflare, so if you later switch the record to DNS only, visitors will see warnings; SSL certificate errors explained covers those messages. Cloudflare has also introduced an automatic mode on some accounts, so check which mode is actually active.

Under Edge Certificates, turn on Always Use HTTPS and keep just one HTTPS redirect in charge rather than stacking it with your host and a plugin. Leave HSTS off unless you are sure: once browsers have seen it, they refuse plain HTTP for months, which turns a later certificate mistake into a full outage.

Step 5: Cache rules, and what never to cache

By default Cloudflare caches static files such as images, CSS and JavaScript and passes HTML pages through to your server; a curl check shows DYNAMIC for those pages. That default is safe for WordPress, and with a caching plugin or host cache at the origin it is enough for many sites. WordPress caching explained shows how the layers fit together.

If you add a Cache Rule to make HTML eligible for caching, add bypass rules first. These must never be cached:

Bypass cache when the URL path:
  contains  /wp-admin/
  equals    /wp-login.php
  starts with /cart/
  starts with /checkout/
  starts with /my-account/
  contains  /wp-json/
or the query string contains  s=  or  preview=
or a cookie name starts with:
  wordpress_logged_in_
  woocommerce_items_in_cart
  wp_woocommerce_session_
  comment_author_

Adjust the paths if your store uses different page slugs. Matching on cookies may not be available on every plan, which is why many free-plan sites leave HTML caching off or use APO instead. Use Development Mode while editing the design, and purge the cache after changes. For store-specific caching, see WooCommerce speed optimization.

Step 6: APO, cache plugins and who does what

Automatic Platform Optimization (APO) is Cloudflare's option for caching whole WordPress pages on its network. It works with the official Cloudflare WordPress plugin, which purges pages when content changes, and is designed to skip logged-in users and common WooCommerce pages. For free-plan sites it is a paid add-on at the time of writing, so check current pricing. It helps visitors far from your server; it won't fix a slow server, because wp-admin, checkout and uncached pages still depend on it.

Your setup	Sensible split
LiteSpeed server with LiteSpeed Cache	LiteSpeed caches pages at the origin; Cloudflare caches static files. Connect Cloudflare in the plugin's CDN settings with an API token so purges reach both
WP Rocket or another cache plugin	The plugin caches pages at the origin; use its Cloudflare add-on or the official plugin for purging
APO	APO caches HTML at the edge; keep a page cache at the origin for cache misses

Let one WordPress plugin handle minification and file optimisation. Test Cloudflare's Rocket Loader on key pages before keeping it, because it can break sliders, menus and some payment scripts.

Step 7: Restore real visitor IP addresses

With traffic arriving through Cloudflare, your server may see Cloudflare's IP addresses instead of your visitors'. Cloudflare sends the real address in a header called CF-Connecting-IP. If WordPress ignores it, a login limiter can block everyone at once, and order and comment logs become useless.

To check, log in and look at the IP your security plugin logged for you, or the IP on a recent order or comment. If it isn't your own, ask your host whether it restores real IPs at server level, which is the safest option, or set your security plugin to read the Cloudflare header. Trusting that header from anywhere other than Cloudflare's network lets attackers fake their IP, so server-level handling is better.

Step 8: Firewall and bot basics on the free plan

• Custom rules: the free plan includes a small number, at the time of writing. Useful ones are a managed challenge on wp-login.php and blocking xmlrpc.php if nothing on the site needs it; see WordPress xmlrpc.php explained.
• Bot Fight Mode: challenges traffic that looks automated, but can also block payment gateway callbacks, uptime monitors and integrations, and on the free plan you may not be able to make exceptions. If orders stop updating after payment, test with it off.
• Under Attack mode: challenges every visitor. Use it during an attack, then turn it off.
• Don't challenge Googlebot: after adding rules, run a page through URL Inspection's live test in Search Console.

Step 9: Test everything

1. Browse key pages logged out, in a private window and on mobile data.
2. Check headers: run curl -I on an image and on the cart page. The image should show cf-cache-status: HIT after a second request; the cart should show DYNAMIC or BYPASS.
3. Log in and out, submit every form, and place a test order through to the payment return page.
4. Send and receive email at the domain.
5. Confirm your real IP appears in logs.

If the padlock disappears after turning on Cloudflare, the page is probably loading some files over http; see how to fix a mixed content warning in WordPress.

Troubleshooting after the switch

Symptom	Likely cause	Fix
Too many redirects	Flexible SSL, or duplicate HTTPS and www redirects	Full (strict) and one redirect
Email stopped	MX or TXT records missing, or mail hostnames proxied	Restore records, set them to DNS only
Empty cart or checkout errors	A cache rule catching dynamic pages	Add bypass rules, purge
Everyone locked out of wp-admin	Login limiter sees one Cloudflare IP for all visitors	Restore real IPs, clear the lockout
Payments not marking orders paid	Bot Fight Mode or a rule blocking gateway callbacks	Turn it off or adjust the rule
Error 521, 522 or 523	Server down, firewall blocking Cloudflare, or a wrong IP in DNS	Check the A record and ask your host
Error 525 or 526	Missing or invalid certificate on the server	Install or renew it

Send your host the Ray ID from the error page, the time and the URL. For timeouts that start on the server, see 502 and 504 errors on WordPress.

Quick check: is Cloudflare set up right?

1. In Cloudflare, open SSL/TLS and check the mode is Full (strict) if your host has a valid certificate.
2. Check the response headers in Chrome DevTools (F12) Network tab for "cf-cache-status".
3. Log in to /wp-admin and check pages and the cart are not cached for logged-in users.

When to get help

Get help when Cloudflare causes redirect loops or stale pages, or when you want it set up properly. WordPress speed optimisation covers this kind of work, with a written scope before anything starts. You can also send the details through the contact form.

FAQs

Is Cloudflare's free plan enough for a WordPress site?

For most small business sites, yes: it gives you DNS, a CDN for static files, SSL at the edge and basic protection. Paid options such as APO matter more for sites with visitors spread across regions or very busy stores.

Should I use Flexible SSL on Cloudflare?

No. Flexible sends traffic to your server unencrypted and causes redirect loops with WordPress. Install a certificate on your hosting and use Full (strict).

Do I need the Cloudflare WordPress plugin?

It is required for APO. Without APO, it is optional; your cache plugin's Cloudflare integration can handle purging instead. Don't run two tools that both try to manage Cloudflare.

Will moving to Cloudflare break my email?

Only if MX, SPF, DKIM or mail hostname records are missing or proxied. Check them against your old zone before changing nameservers.

Does Cloudflare help SEO?

Indirectly, through faster static files and better uptime under load. It won't lift rankings by itself, and an aggressive bot rule that challenges Googlebot can hurt, so test after adding rules.