Cloudflare Configuration
Cloudflare configuration sets up DNS, caching, security and bot protection in front of your site. Default settings are deliberately conservative and cache almost nothing dynamic, so most of the available speed and security benefit only arrives once rules are configured for your specific stack.
Prices shown are starting points. The final cost depends on the size and scope of your project, and we confirm it in writing before any work begins.
Most sites we look at are on Cloudflare with everything left at defaults. That gives you DNS and basic DDoS protection and very little else: caching is minimal, the firewall is passive, and bot traffic passes through untouched.
Configured properly it does considerably more: cache rules that serve static assets from the edge, firewall rules that block the scanning traffic hammering your login page, and bot management that keeps scrapers off your product data while letting search and AI crawlers through.
The care needed is around what must never be cached: cart, checkout, account and admin paths. Caching those breaks stores in ways that are confusing to diagnose, which is why aggressive caching gets rolled back rather than fixed.
What's included
- DNS migration and record verification
- SSL/TLS mode configured correctly for your origin
- Cache rules with correct bypass for cart, checkout and admin
- WAF rules tuned to your platform
- Bot management with search and AI crawlers allowed
- Rate limiting on login and form endpoints
- Image and asset optimisation settings
- Origin protection so the server cannot be reached directly
- Configuration documented for your records
Questions people actually ask
Is the free Cloudflare plan enough?
For most sites, yes. The free tier includes DNS, CDN, basic WAF and unmetered DDoS protection: the limitation is rule count and some advanced bot features, not raw capability. Upgrade when you hit a specific limit, not on principle.
Will Cloudflare break my store?
It can, if caching is applied indiscriminately. Cart, checkout, account and admin paths must bypass cache, or customers see each other's carts and logins behave unpredictably. Correct bypass rules are the whole job.
Should I block AI crawlers with Cloudflare?
Only deliberately. Cloudflare makes blocking AI bots a one-click option, and it will also remove you from AI search answers. If being cited by ChatGPT and Perplexity matters to you, leave them allowed.
Does Cloudflare replace my hosting?
No. It sits in front of your hosting as a proxy and CDN. Your origin server still serves the site; Cloudflare caches, filters and accelerates what reaches it.