4 Cloudflare features worth enabling: DNS, CDN, SSL, DDoS

The problem without Cloudflare

Your website runs directly on a server with nothing in front of it. That means:

DNS points straight to your server's IP — anyone can see your real IP
Static files, images, CSS, JS all load from your server — consuming bandwidth and adding latency for distant users
SSL requires manual cert installation and renewal — forget to renew and your site shows a security warning
Your server receives every request directly, including flood traffic from bots and attackers

Cloudflare sits in the middle and handles all four of these problems — mostly for free.

1. DNS — faster resolution and hidden origin IP

How standard DNS works

When a user types yoursite.com, their machine asks a DNS server: "What's the IP for this domain?" The DNS server returns the IP, and the browser connects directly to it.

The problems: DNS lookup adds latency, and your server's IP is publicly exposed.

What Cloudflare DNS does differently

Cloudflare operates one of the largest DNS networks in the world, with over 300 edge locations. When you use Cloudflare as your nameserver:

DNS queries are resolved at the edge location closest to the user — typically under 10ms
Anycast routing means the same IP routes to the nearest server automatically
When Proxy is enabled (orange cloud icon): Cloudflare hides your server's real IP — users only see Cloudflare's IP, protecting your origin from direct attacks

Proxy vs DNS only

	DNS Only (grey cloud)	Proxied (orange cloud)
IP shown	Real server IP	Cloudflare IP
CDN	No	Yes
DDoS protection	No	Yes
SSL termination	At server	At Cloudflare
Use for	Mail, SSH, FTP	Website, API

Important: don't enable Proxy for MX records, mail subdomains, or any service that requires the real IP (VPN, game server, FTP). Only proxy A/CNAME records for your website and API.

Faster propagation

Cloudflare allows TTL as low as 1 minute for DNS records, while many other providers enforce a minimum of 5–30 minutes. When you need to change servers or failover, the change takes effect almost immediately.

2. CDN — cache static assets at the edge, reduce origin load

What CDN means in practice

A CDN (Content Delivery Network) stores copies of static files — images, CSS, JS, fonts, video — on servers distributed worldwide. A user in London loads a file from a nearby edge node instead of from your server in Singapore.

When you enable Proxy in Cloudflare, CDN activates automatically — no additional configuration needed.

What Cloudflare caches by default

Cloudflare automatically caches files by extension:

Images: .jpg, .png, .gif, .webp, .svg, .ico
Code: .css, .js, .woff, .woff2
Documents: .pdf, .txt
Not cached by default: HTML, API responses, cookie-based content

Each request to a Cloudflare edge node is checked:

HIT: file is in cache → returned immediately, origin server is never touched
MISS: not cached yet → fetched from origin, stored in cache for next time
EXPIRED: TTL passed → re-fetched from origin

Why CDN matters for your origin server

Without a CDN, every page load is a request to your server. With 1,000 concurrent users each loading a page with 20 static assets, your server receives 20,000 requests per second just for static files.

With CDN, most requests are served from the edge — your server only receives requests for dynamic content (API, server-rendered HTML).

Custom cache rules

Cloudflare Dashboard → Caching → Cache Rules

Example — cache all HTML for a static blog:

If: URI Path matches /blog/*
Then: Cache Eligibility → Eligible for cache, Edge TTL → 1 hour

Example — bypass cache for the admin panel:

If: URI Path starts with /admin
Then: Cache Eligibility → Bypass cache

Free speed optimizations

In the Speed tab, Cloudflare offers several free optimizations:

Auto Minify: strips whitespace and comments from HTML, CSS, JS
Brotli: compresses responses with Brotli instead of gzip — ~20% better compression ratio
Early Hints: sends 103 Early Hints headers so browsers can preload resources before the full response arrives

3. SSL — automatic HTTPS, no cert management needed

The problem with managing SSL yourself

Self-managed SSL certificates mean:

Using Let's Encrypt with certbot, cron jobs for renewal
Forgetting to renew → cert expires → users see a security warning → trust lost
Configuring nginx or Apache correctly to serve HTTPS
Wildcard certs cost money or are complex to set up

Cloudflare's Universal SSL

Once you add a domain to Cloudflare and enable Proxy, Cloudflare automatically issues a free SSL cert for your domain and *.domain.com (wildcard). The cert auto-renews — you never touch it.

Users connect to Cloudflare over HTTPS. The connection from Cloudflare back to your origin is a separate leg.

SSL modes

Cloudflare Dashboard → SSL/TLS → Overview

Mode	Description	Use when
Off	No SSL	Never
Flexible	HTTPS user→Cloudflare, HTTP Cloudflare→server	Server has no cert but you want HTTPS for users
Full	HTTPS both ways, but server cert not verified	Server has a self-signed cert
Full (Strict)	HTTPS both ways, server cert must be valid	Server has a valid cert (Let's Encrypt or CA)

Recommended: use Full (Strict) if your server already has a cert. Flexible is a security gap — the connection from Cloudflare to your origin is unencrypted HTTP.

Force HTTPS

SSL/TLS → Edge Certificates → Always Use HTTPS → On

Redirects all HTTP requests to HTTPS automatically. No redirect rules needed in nginx or Apache.

HSTS

SSL/TLS → Edge Certificates → HTTP Strict Transport Security (HSTS)

Enabling HSTS tells browsers to remember "this site always uses HTTPS" and never attempt HTTP again — even if the user types http://. Increases security and removes one redirect round-trip.

4. DDoS Protection — filter traffic before it reaches your server

What DDoS looks like in practice

A DDoS (Distributed Denial of Service) attack floods your server with traffic from many sources simultaneously, overwhelming it so it can't serve real users.

Three common attack layers:

Layer 3/4 (Network/Transport): UDP floods, TCP SYN floods — saturate bandwidth
Layer 7 (Application): HTTP request floods — exhaust server CPU
Slowloris: opens many connections and sends requests extremely slowly to hold all threads

How Cloudflare DDoS Protection works

Because Cloudflare sits in front of your server, all traffic must pass through it first. Cloudflare analyzes traffic in real-time and filters before forwarding to your origin:

Detects abnormal patterns (sudden spikes, known botnet IPs, unusual request signatures)
Automatically blocks or challenges malicious traffic
Cloudflare's DDoS absorption capacity exceeds 100 Tbps — more than most attacks can generate
Your origin server only receives clean traffic

This happens automatically on the Free plan with no configuration needed.

Under Attack Mode

When you're actively under a heavy attack:

Cloudflare Dashboard → Overview → Under Attack Mode (fire icon)

Enabling this adds a JavaScript challenge to all requests before letting them through. Bots can't pass it. Real users see a 5-second loading screen then proceed normally.

Only enable this during an active attack — it affects user experience and search engine crawling.

Rate Limiting

Security → WAF → Rate Limiting Rules

Limit requests from a single IP within a time window:

Example: max 100 requests per minute for /api/*
Exceeding the limit → returns 429 or shows a challenge
Protects API endpoints from scraping and brute force

Basic rate limiting is available on the Free plan with some restrictions. More complex rules require a paid plan.

WAF (Web Application Firewall)

Security → WAF

Cloudflare Managed Rules block common attacks — SQL injection, XSS, path traversal — based on a continuously updated ruleset. The Free plan includes a limited ruleset; Pro and above unlock the full set.

Order of operations when adding a new domain

Switch nameservers to Cloudflare — required for everything else to work
Enable Proxy on A/CNAME records for your website (orange cloud)
SSL → Full (Strict) if your server has a cert, or Full if not
Always Use HTTPS → On
Auto Minify + Brotli → enable in Speed settings
Verify the site still loads correctly after enabling Proxy

What Cloudflare Free doesn't include

To set the right expectations:

Detailed analytics: Free plan only retains 24 hours of data
Advanced custom cache rules: limited on Free
Load Balancing: requires a paid plan
Full WAF ruleset: Free only includes basic rules
Priority support: not available on Free
Advanced Bot Management: Enterprise only

For most personal websites, side projects, and small startups, the Free plan covers all four features above at a level that's fully production-ready.