Cloudflare Expert in Melbourne: Spam and Bots Stopped, Google Left Alone

Alongside, and the split matters. Cloudflare stops traffic before it reaches your server, which is the only thing that helps when the problem is volume: a plugin cannot save you from load it has to boot WordPress to evaluate. The plugin is still what watches file changes and users inside the site. What we usually remove is the overlap: two products rate-limiting the same login screen tend to produce confusing results rather than twice the protection.

Yes, for the automated part, which is most of it. The bulk of form spam is automated, and a Turnstile challenge stops nearly all of it without asking your visitors to identify traffic lights. What it will not stop is a human being paid to fill in forms, which is rarer than people think but does happen, and if that is what you have, the answer is different and we will say so rather than selling you the same fix twice.

That is the failure mode we design against, which is why we prefer narrow rules over broad ones and challenges over outright blocks. A challenge that a real person passes in a second costs you almost nothing; a block costs you the customer with no way to know it happened. Everything goes on in log-only mode first where the rule type supports it, so we can see what a rule would have caught before it catches anything.

Usually not. The free plan includes the WAF rules, Turnstile, the caching rules and the verified-bot handling that this work is mostly made of. Paid plans buy you more rules, finer bot controls and better analytics, and there are sites that genuinely need them: a shop under sustained attack, for instance. We will tell you if yours is one, and we have no interest in you upgrading if it is not.

Correctly configured, it does no harm, and it usually makes the site faster for visitors further away: page speed is something Google measures. Incorrectly configured it can hurt badly, by challenging Googlebot or caching a redirect it should not have. That is not an argument against Cloudflare, it is an argument for checking afterwards, which is part of this work rather than an extra.

Sometimes, and it is worth finding out before rather than after. Two caching layers in front of each other are not twice as fast; they are twice as hard to clear, and a stale page can survive a purge of the layer you thought was responsible. Some hosts also object to proxying in their terms. We check what is already in front of the site and either integrate with it or recommend turning one of them off, with a reason.

Yes. The DNS change itself is not a downtime event, and the rules go on afterwards one at a time rather than as a single configuration dump. The part that needs care is the SSL mode: set wrong during a move it produces a redirect loop, which is the one failure people associate with Cloudflare migrations. We set it to match how your origin actually serves the site rather than to whatever is fastest to click.

You do. We would rather be added to your account than create one you have to prise out of us later, and if the site is already in an old agency's account we will help you move it. The same applies to the DNS records: you get a copy of what they were before we touched anything, which matters more than it sounds when your email stops working and everyone is guessing.

That is the clearest case for this work. The first step is identifying what it actually is, because it often turns out to be a legitimate crawler on a site that generates a near-infinite number of URLs (faceted filters and calendars are the usual culprits) in which case rate limiting is treating the symptom and the real fix is upstream. Otherwise it is usually scrapers, and those simply get stopped.

The risk is entirely in the caching rules, and it is real: cache the wrong thing and you can serve one customer a page built for another. That is why bypasses for cart, checkout, account and the logged-in cookie go on before caching is turned up, and why we test with a real order rather than declaring it done. Handled in that order it is one of the better things you can do for a shop, because it takes load off the server for exactly the pages that do not need it.