What is Cloudflare?
Author: Domeny.ForSale editorial team Published
In brief: Cloudflare is a network services platform that can speed up website delivery, manage domains and reduce malicious traffic. In a typical configuration, it sits between the visitor and the website’s server, but does not replace its hosting. Using Cloudflare’s DNS alone does not mean that website traffic passes through its protection systems.
How Cloudflare works in front of a website’s server
Without an intermediary, the browser connects to the server running the website. Once the appropriate configuration is enabled, Cloudflare first accepts the user’s connection, then either responds from its own cache or retrieves content from the origin server. The origin server is simply the hosting or other infrastructure on which the actual website runs.
This arrangement is called a reverse proxy. It allows traffic to be checked before it is passed to the server and some requests to be handled without involving the hosting. It can also hide the server’s IP address in DNS responses for supported records, but does not guarantee that the address remains secret—it may have been exposed previously or through other services.
For example, a shop is hosted in Poland, while a customer browses its products from Spain. If product images are stored in Cloudflare’s cache, they can be delivered from a node in its network closer to the customer. The shopping cart and payment still require communication with the shop’s application.
DNS, CDN and protection—what these features mean
DNS is the system that identifies the addresses at which a domain’s services operate. Cloudflare can maintain its records: entries that direct traffic to services such as the website and email. This is a separate function from proxying web traffic.
For supported website records, you can choose between two modes in the dashboard:
- DNS only, indicated by a grey cloud: Cloudflare provides the DNS response, but the browser connects directly to the specified server.
- Proxied, indicated by an orange cloud: traffic passes through Cloudflare and can use its performance and security features.
A CDN, or content delivery network, stores copies of selected resources across distributed infrastructure. These include, for example, images, stylesheets and JavaScript files. Cloudflare does not automatically cache every response from a website; cache behaviour depends on the resource type, headers and configured rules.
DDoS protection helps mitigate attacks that flood a service with traffic. A WAF, or web application firewall, analyses requests to a website and can block those matching attack rules. The availability of specific rules, limits and bot management tools depends on the plan and configuration.
Cloudflare also supports HTTPS encryption. However, both connection segments need attention: user–Cloudflare and Cloudflare–server. The certificate visible in the browser is not enough to confirm that the second segment is properly secured.
Does Cloudflare replace hosting, and is it free?
In a typical deployment, Cloudflare does not take over the website’s files, database or mailboxes. You still need hosting and a separate email service. The company also offers tools for publishing applications and websites, such as Workers and Pages, but these are separate solutions, not an automatic result of connecting a domain.
There is a free plan that lets you use basic DNS, CDN and protection features. This does not mean that all Cloudflare products are free or have the same limits. Before choosing, check the current plan comparison and documentation for the specific service on Cloudflare’s official website, particularly billing terms, support and feature restrictions.
Cloudflare does not replace updates to your website’s software, backups or security measures for administrator accounts. Nor will it fix a faulty application: if the problem is a slow database query, enabling proxying alone may not speed up response generation.
How to connect a domain safely
In the most common setup, you add the domain to your Cloudflare account, check its DNS records, then change the nameservers at your domain provider. Nameservers identify who manages DNS responses. This change is not a domain transfer to another registrar.
Before switching, carry out a brief check:
- Save your current DNS configuration. Compare it with the entries imported into Cloudflare; automatic detection may miss some records.
- Check email. Preserve MX records and SPF, DKIM and DMARC entries. Hosts used for standard email connections should operate in DNS only mode, not through the standard website proxy.
- Verify DNSSEC, the mechanism for signing DNS data. If it is active, follow the migration instructions; leaving a mismatched DS record at your domain provider can prevent the domain from resolving.
- Configure encryption to the server. Aim to use Full (strict) mode and a valid certificate on your hosting. Flexible mode does not encrypt the connection segment to the server and can cause redirect loops.
- Test key functions. Check the website, forms, login, purchases, and sending and receiving email.
Do not immediately enable aggressive caching of the entire website. Caching personalised responses without appropriate exceptions can result in outdated content being displayed, or even someone else’s data. The shopping cart, customer account and administration panel require particular care.
When Cloudflare makes sense
Cloudflare can be useful when you want to manage DNS centrally, reduce the load on your hosting by offloading file delivery, or filter unwanted traffic. The best way to assess the benefit for a particular website is to compare speed and error counts before and after deployment.
An intermediary also adds another layer of configuration and a dependency on an external provider. Overly restrictive rules can block genuine customers, while connection errors involving the hosting require checking both services. If your hosting already provides a CDN and protection, first establish what additional problem Cloudflare is meant to solve.
Start with an inventory of DNS records and one specific deployment goal. Only add further protection and caching rules after checking that the website works.
Read also
