Cloudflare Setup Tutorial: Secure Your Website in 5 Steps

To set up Cloudflare on a WordPress site, add your domain to a free Cloudflare account, check the imported DNS records, change your domain’s nameservers at the registrar, then set SSL/TLS to Full (strict) and turn on Always Use HTTPS. The hands-on work is short; the only wait is the nameserver change spreading. This guide uses the Free plan and shows each screen as I saw it.

Before you start

• Log-in details for the place your domain is registered. This is the registrar, and it is not always your web host. For a .au domain, it is whichever registrar you bought it through.
• A working site with a valid SSL certificate on the host. Cloudflare’s strict SSL mode needs one.
• A list of the email services on the domain (Google Workspace, Microsoft 365, your host’s mailboxes). You will check that their records survive the move.
• A quiet time to switch. DNS changes are safe, but do not do this the hour before a campaign launches.

Step 1: Add your domain and pick the Free plan

Create a Cloudflare account, log in and choose the option to add a domain. Enter the domain only, such as example.com.au, without https:// or www.

Cloudflare then scans the domain’s current DNS and offers to import what it finds. Leave the import on. It copies your A records, CNAMEs and, importantly, your MX and TXT records, which is what keeps email working.

When asked for a plan, pick Free. It covers everything in this guide. Paid plans such as Pro add extras you can look at later; none of the steps below need them.

Step 2: Check the imported DNS records

Cloudflare shows the records it found. Read them against what you know about the site before you continue. The scan is good but it is not perfect, and a missing record is much easier to fix now than after the switch.

Two things to get right:

• Web records (A, AAAA and the CNAME for www) can be proxied. The orange cloud means traffic goes through Cloudflare. That is what gives you the CDN and the protection.
• Email records must stay DNS only. MX records can never be proxied, and any record that points to a mail server, such as mail.example.com.au, should show the grey cloud. TXT records for SPF, DKIM and DMARC are plain text and are copied across as they are.

If you send mail through a service your host provides, compare the MX and TXT records with what your host’s DNS page shows. If a record is missing in Cloudflare, add it by hand before you change nameservers.

Step 3: Change the nameservers at your registrar

Cloudflare now gives you two nameservers to use. Copy both exactly.

Log in where the domain is registered, find the nameserver setting for the domain and replace the existing nameservers with the two from Cloudflare. For a .au domain, this is done at the registrar you registered it through, not in Cloudflare and not necessarily at your web host. If your registrar and your host are the same company, the setting is often under a DNS or nameservers section for the domain.

My example uses a Hostinger panel. The screens are different at other registrars and hosts, but the task is the same: switch from the default nameservers to custom ones and paste in Cloudflare’s two.

Leave any child nameserver (glue record) settings alone. Save the change.

Step 4: Wait, then confirm Cloudflare is active

Nameserver changes can take anywhere from a few minutes to about a day to spread. Your site keeps working during this time, because the records Cloudflare holds match the ones you had.

You can watch it from two places. A public lookup such as dnschecker.org shows which nameservers the world is seeing for your domain; search for the NS records and wait until they show Cloudflare’s names.

The other is the Cloudflare dashboard itself. Once it has detected the change, the domain’s overview shows it as Active, and Cloudflare sends an email. If it still says pending after a day, recheck the nameservers at the registrar for typos and make sure you replaced the old ones rather than adding to them.

Step 5: Set SSL/TLS to Full (strict) and turn on Always Use HTTPS

This is the step that most often breaks a WordPress site, so take it slowly. In the SSL/TLS section, Cloudflare’s encryption mode decides how it talks to your host.

• Flexible encrypts the visitor’s connection to Cloudflare but talks to your server over plain HTTP. If WordPress already redirects everything to HTTPS, that causes an endless redirect loop and the browser reports “too many redirects”.
• Full encrypts both legs but does not check the certificate on your server.
• Full (strict) encrypts both legs and checks that the certificate on your host is valid and matches the domain. This is the one to use on a normal WordPress site with a working certificate.

If the site breaks after you pick Full (strict), the usual cause is a missing or expired certificate on the host, not Cloudflare. Fix the certificate at the host, or as a short-term step drop to Full while you sort it out. Choose Flexible only when your host genuinely cannot serve HTTPS, and plan to fix that, because it leaves the last leg unencrypted.

Next, open the Edge Certificates page and switch on Always Use HTTPS. Anyone who types or follows an http:// link is then redirected to https:// at Cloudflare’s edge. Your WordPress Address and Site Address under Settings, General should already start with https://.

Caching without breaking WordPress

With the free plan, Cloudflare caches static files such as images, CSS and JavaScript by default. It does not cache your HTML pages unless you tell it to, and for most small business sites that default is the safe choice. If you do add page caching rules, keep these in mind:

• Never cache /wp-admin/ or /wp-login.php. Add a rule that bypasses cache for those paths, or you can end up with admin screens that look logged out or stale.
• Bypass cache for logged-in users. A rule that matches the wordpress_logged_in_ cookie does this.
• Never cache the cart, checkout or account pages on a WooCommerce store, and skip the woocommerce_items_in_cart cookie too. Caching these can show one customer another customer’s basket.
• Cloudflare APO (Automatic Platform Optimization) is optional and paid. It caches WordPress HTML at the edge and handles most of the cookie rules for you through the Cloudflare plugin. You do not need it for this setup.
• Be careful with Rocket Loader. It defers JavaScript, and on sites with sliders, page builders or checkout scripts it can stop things working. If something breaks after you turn Cloudflare on, switch Rocket Loader off first.

If you also use a caching plugin, change one setting at a time and test after each, so you know which one caused a problem. If a plugin like WP Rocket or LiteSpeed Cache already caches your pages, you can usually leave Cloudflare at its default and avoid two layers fighting each other.

Check that it worked

1. The domain shows as Active in the Cloudflare dashboard.
2. Visit the site at both http:// and https://. You should land on the https:// version with a padlock and no redirect loop.
3. Log in to /wp-admin/, open a post, and save a change. It should save and display as normal.
4. Send a test email to and from an address on the domain.
5. If the site sells things, put an item in the cart and go to checkout as a guest and as a logged-in customer.

What this setup does and does not do

This setup puts your domain’s DNS on Cloudflare, encrypts traffic between the visitor, Cloudflare and your host, and puts a CDN in front of your static files. It does not stop a vulnerable plugin from being exploited, it does not replace updates and backups, and it does not harden WordPress itself. Cloudflare’s own firewall rules and bot settings are the next layer. I cover them in the Cloudflare security rules guide.

If you would rather not touch DNS on a live business site, you can have Cloudflare set up for your site and checked end to end.

Frequently asked questions

Will changing nameservers take my website offline?

It should not. Cloudflare imports your existing records, so the site and email keep resolving during the change. The risk is a record the scan missed, which is why you check the DNS list in Step 2 before you switch.

Is the Free plan enough for a WordPress site?

For DNS, SSL and a CDN for static files, yes. Plans such as Pro add extra features, and APO is a separate paid add-on, but you do not need either to follow this guide.

Why do I get “too many redirects” after turning Cloudflare on?

Almost always the SSL/TLS mode is set to Flexible while WordPress already forces HTTPS. Change the mode to Full (strict), provided your host has a valid certificate, and clear your browser cache.

Does Cloudflare replace a WordPress security plugin?

No. Cloudflare filters traffic before it reaches your host. A security plugin, updates and backups deal with what happens inside WordPress. They do different jobs.