Recommended Free Tools
For most WordPress sites, the best Cloudflare configuration is: point the domain to Cloudflare, use Full (strict) SSL/TLS with a valid origin certificate, redirect all HTTP traffic to HTTPS, and enable the Cloudflare WordPress plugin with Automatic Platform Optimization (APO) for anonymous HTML. Keep logged-in, administrator, account, cart, checkout, and other transactional requests out of the public cache. Disable overlapping page-cache plugins while you test, then verify behavior with Cloudflare response headers before adding complexity.
The recommended baseline configuration
This baseline suits a conventional single-site WordPress installation with a publicly accessible origin server. It improves delivery of anonymous pages without exposing private sessions or commerce data.
As an Amazon Associate I earn from qualifying purchases.
For a managed WordPress base alongside these Cloudflare controls, Antihost provides isolated resources for each site, one-click staging, automated and manual backups, free SSL, and WooCommerce support.
Free tools Windows power users keep installed
One-click scans. No signup required.
- DNS: reproduce the origin’s DNS records in Cloudflare, then change the registrar’s nameservers to the two nameservers Cloudflare assigns.
- Encryption: select Full (strict) when the origin serves a valid certificate from a public certificate authority or a Cloudflare Origin CA certificate.
- HTTPS: enable an HTTP-to-HTTPS redirect. Use Automatic HTTPS Rewrites only to repair old HTTP references in page content or assets; it is not a substitute for the redirect.
- WordPress integration: install the Cloudflare WordPress plugin, authenticate with a least-privilege API token, apply the recommended WordPress settings, and enable APO when the plan supports it.
- Cache safety: allow anonymous, cacheable GET and HEAD requests while bypassing logged-in users, administrators, WooCommerce activity, feeds, cron, checkout, and any other personalized response.
- Validation: inspect
cf-cache-status,cf-apo-via, andcf-edge-cacheheaders, and test both public and dynamic paths.
Prepare DNS and the origin before enabling cache
Confirm every DNS record
Cloudflare must know where the site, mail, verification records, and any subdomains live. Copy the existing A, AAAA, CNAME, MX, TXT, and other required records into the Cloudflare DNS dashboard before changing nameservers. A missing MX or TXT record can interrupt mail or domain verification even when the website itself still loads.
#1 Best Overall
Change nameservers at the registrar
At the domain registrar, replace the current nameservers with the pair assigned by Cloudflare. The change becomes effective after DNS delegation propagates. Do not delete the old DNS information until the Cloudflare zone contains an equivalent record set and the domain resolves correctly.
Make the origin serve HTTPS
Install or renew a certificate on the web server before selecting Full (strict). A publicly trusted certificate and a Cloudflare Origin CA certificate are both acceptable for strict validation. Confirm that the certificate covers the hostname visitors use and that the server presents the correct certificate on every relevant virtual host.
Set up the Cloudflare WordPress plugin and APO
APO is Cloudflare’s WordPress-aware edge cache. It can cache eligible dynamic HTML at Cloudflare locations, reducing trips to the origin and potentially improving time to first byte. On the free Cloudflare plan, APO is a paid add-on; Pro and higher plans can proceed through the plugin setup described by Cloudflare. Check the account’s current plan screen because entitlement and pricing can change.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Install the plugin: in WordPress, open Plugins > Add New Plugin, search for the official Cloudflare plugin, install it, and activate it.
- Create credentials: in Cloudflare, create an API token from the WordPress template. Use the template’s least-privilege permissions rather than a global API key. Copy the token once and store it securely.
- Authenticate: return to the plugin settings, enter the token, and select the correct Cloudflare account and zone.
- Apply the baseline: choose Apply Recommended Cloudflare Settings for WordPress. Review the changes before saving if the site already has custom rules.
- Enable APO: turn on Automatic Platform Optimization in the plugin after DNS delegation and HTTPS are working. Purge any stale server-side page cache after activation.
- Test before expanding: use a staging site or a low-risk production window to check navigation, forms, consent tools, analytics, memberships, and commerce flows.
Cloudflare lists APO as unsupported for WordPress multisite. A multisite network should therefore not be treated as an ordinary single-site APO deployment; use carefully scoped Cloudflare cache rules and origin-side caching instead, or follow a documented architecture that accounts for the network’s hostnames and cookies.
Choose the right SSL/TLS encryption mode
Cloudflare’s current guidance states: “If possible, Cloudflare strongly recommends using Full or Full (strict) modes to prevent malicious connections to your origin.” The practical target is Full (strict) whenever the origin certificate is valid.
| Mode | Cloudflare-to-origin connection | When to use it | Main limitation |
|---|---|---|---|
| Full (strict) | HTTPS with certificate validation | The origin has a valid public-CA or Cloudflare Origin CA certificate. | Requests fail if the certificate is expired, mismatched, untrusted, or otherwise invalid. |
| Full | HTTPS without validating the certificate | Temporary compatibility when the origin supports HTTPS but its certificate cannot yet be validated. | It does not verify the origin’s identity. Replace the certificate and move to Full (strict). |
| Flexible | HTTP from Cloudflare to the origin | Only as a short-term fallback for an origin that cannot accept HTTPS. | The origin leg is unencrypted and can create redirect loops or mixed-content problems. |
Prevent redirect loops
Set the origin to recognize the HTTPS protocol forwarded by Cloudflare. If WordPress or the web server sees only HTTP while Cloudflare serves HTTPS, an HTTP-to-HTTPS redirect can loop. Check the site’s canonical URL settings, web-server rewrite rules, and any proxy-aware configuration before forcing the redirect globally.
Use Automatic HTTPS Rewrites correctly
Enable Automatic HTTPS Rewrites when old image, stylesheet, script, or link references still contain http://. The feature rewrites eligible URLs in responses, but it does not repair every hard-coded or JavaScript-generated reference. Update the source URLs as well, then use a browser’s developer tools to locate remaining mixed-content requests.
Automatic SSL/TLS recommendations
Cloudflare is rolling out Automatic SSL/TLS recommendations and says the system will not downgrade a domain to a less secure mode. Automatic recommendations still depend on a healthy origin certificate. Keep that certificate valid and monitor expiration even when the dashboard manages the mode.
Understand what APO caches
APO is not a blanket “cache everything” switch. A request must satisfy several conditions before Cloudflare can serve the HTML from the edge:
- It uses
GETorHEAD. - The request advertises an HTML-capable
Acceptheader or targets an eligible path. - The origin returns a successful 200 HTML response.
- WordPress grants edge caching through the
cf-edge-cachepermission signal. - The request does not contain a bypass cookie, a no-cache directive, or an excluded path.
Checkout, wp-cron.php, and feeds are examples of excluded paths. A response can be correctly delivered from the origin even when it is not cacheable; a cache miss is not automatically a configuration error.
APO’s cache lifetime and purging
Cloudflare’s FAQ says APO automatically caches content for 30 days and invalidates changes within 30 seconds when the WordPress plugin is installed. These are Cloudflare’s stated defaults, not a guarantee that every custom cache rule or origin header behaves identically. Existing cache rules can still affect APO, and separate Edge Cache TTL page rules are generally unnecessary for a standard APO setup.
Protect logged-in users and WooCommerce sessions
Public edge caching is appropriate for an anonymous article, but it is dangerous for a response containing a customer’s account details, cart, order, or checkout token. Cloudflare states that logged-in and administrator users bypass the cache, and its WordPress guidance describes caching anonymous page views while bypassing WooCommerce activity.
Keep the plugin’s default bypass behavior and preserve bypasses for any custom application that uses cookies or private sessions. At minimum, keep these paths or states out of a shared cache:
- WordPress login, admin, and dashboard requests.
- Requests carrying WordPress authentication or session cookies.
- WooCommerce cart, checkout, account, order-confirmation, and payment-return pages.
- Membership, profile, search-with-private-results, and personalized dashboard pages.
- POST requests and endpoints that change data.
- Feeds, cron jobs, webhooks, API responses, and other machine-facing endpoints unless explicitly designed for caching.
After enabling APO, test with two separate browsers: one logged out and one authenticated. Add an item to a test cart, open checkout, log in, and verify that account information never appears in a logged-out browser or an incognito window.
APO compared with manual Cloudflare cache rules
APO is the simpler WordPress-specific path. Manual rules provide more control but require you to understand cookies, headers, query strings, and every dynamic route. Cloudflare recommends modern Cache Rules rather than legacy Page Rules when custom control is needed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Decision factor | APO | Manual Cache Rules |
|---|---|---|
| Eligibility | Uses the WordPress plugin’s edge-cache signal and Cloudflare’s built-in HTML checks. | You define hostnames, paths, methods, headers, cookies, and cacheability conditions. |
| Bypass handling | Designed to bypass logged-in and administrator users and common WordPress exclusions. | You must maintain every authentication, commerce, preview, and session bypass yourself. |
| Invalidation | The plugin can notify Cloudflare of WordPress changes; Cloudflare states a 30-second invalidation target with the plugin installed. | You choose purge mechanisms and must connect publishing events to them if immediate invalidation is required. |
| WooCommerce compatibility | Works when anonymous pages are cached and commerce sessions retain their bypasses. | Can be precise, but a missing cookie or path exception can expose stale or private HTML. |
| Plugin overlap | Requires testing with any origin page-cache plugin. | Also requires coordination with server and plugin cache headers. |
| Plan and cost | On the free plan, APO is a paid add-on; Pro and higher plans can continue through the plugin setup. | Availability depends on the Cloudflare plan and the specific rule features used; no universal price is stated here. |
| Observability | Supports APO-specific response headers such as cf-apo-via and cf-edge-cache. |
Relies primarily on standard cache headers and your rule expressions. |
| Query strings and exclusions | Cloudflare handles the standard WordPress eligibility model. | You control query-string behavior, excluded paths, and custom cache keys in detail. |
Choose APO first when the site is a conventional single-site WordPress installation. Choose manual rules when the application has unusual cookies, headless routes, multilingual hostnames, or a cache-key policy that APO cannot express safely.
Disable overlapping page caches during the first rollout
Cloudflare recommends turning off WP Rocket, W3 Total Cache, or similar page-cache plugins during initial APO setup. Two systems can each rewrite cache headers, generate different HTML variants, or issue conflicting purge requests. Clear the other plugin’s server cache after APO activation, then test the site with only one page-cache layer active.
If re-enabling a plugin improves origin performance, do so one change at a time. Purge both caches, record the resulting headers, and test anonymous pages, logged-in pages, forms, and checkout. If behavior becomes unpredictable, return to the last known-good single-cache configuration rather than adding more bypass rules blindly.
Rank #4
Performance settings worth enabling cautiously
Image Optimization
Cloudflare’s WordPress support guidance places image controls under Speed > Settings > Image Optimization. Review the available options there and test image quality, responsive sizes, lazy-loading behavior, and compatibility with the theme before applying changes across a high-traffic site.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Rocket Loader
Rocket Loader defers JavaScript. Deferral can improve initial rendering, but it can also change execution order. Test navigation menus, forms, analytics, consent-management tools, payment widgets, sliders, and any script that expects to run immediately. Apply it through a configuration rule to a staging or low-risk path first; exclude scripts that fail rather than disabling all performance features.
Browser Integrity Check
Browser Integrity Check is another available configuration-rule setting. Review its effect on legitimate crawlers, monitoring services, APIs, and older clients before enforcing it site-wide. Security controls should be introduced with a way to identify and exempt a verified legitimate integration.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Verify caching with response headers
Use a request that advertises HTML, then inspect the response headers in browser developer tools or with an HTTP client. Cloudflare’s WordPress instructions identify these combinations as evidence of an APO edge hit:
cf-cache-status: HITcf-apo-via: cachecf-edge-cache: cache,platform=wordpress
A first request may be a miss while Cloudflare fills the edge cache. Repeat the request from a separate anonymous session and check whether the status changes. Do not force a HIT on a private or transactional route merely to make the header look successful.
| Test case | Expected behavior | What a failure suggests |
|---|---|---|
| Anonymous homepage | Eligible HTML can return a cache HIT and APO headers after warm-up. | Check DNS delegation, HTML response status, cache-control headers, and APO activation. |
| Anonymous published post | Usually cacheable if it is a normal GET returning 200 HTML. | Inspect excluded paths, cookies, query strings, and origin no-cache directives. |
| Logged-in dashboard | Served from the origin, not a shared public cache. | A public HIT indicates an unsafe bypass configuration and requires immediate review. |
| WooCommerce cart and checkout | Dynamic origin responses with current session data. | Check WooCommerce cookies, path exclusions, and any custom cache rule that overrides them. |
| Feed | Normally excluded or delivered from the origin. | Review feed-path exclusions and any rule that caches non-HTML or machine-facing output. |
wp-cron.php |
Runs at the origin without edge-page caching. | Remove any broad rule that caches the cron endpoint. |
Troubleshoot the common failure modes
“Full (strict)” shows certificate errors
Check expiration, hostname coverage, the certificate chain, and the certificate actually served by the origin. Renew or replace the certificate, then keep Full (strict). Use Full only as a temporary bridge while the certificate problem is being fixed.
Best Value
- Used Book in Good Condition
Visitors see a redirect loop
Confirm that WordPress’s site URL uses HTTPS, the origin honors Cloudflare’s forwarded protocol, and only one layer is performing the canonical redirect. Temporarily narrow the redirect rule while correcting the origin’s proxy awareness.
APO never returns a HIT
Confirm that the request is GET or HEAD, returns 200 HTML, has no bypass cookie, is not a feed or excluded path, and does not send a no-cache request. Purge the origin page cache, then repeat the request from a clean anonymous session.
New posts show old content
Verify that the Cloudflare plugin is active and authenticated, then publish a small test edit and watch for the stated invalidation behavior. Purge the relevant Cloudflare and origin caches only after checking that another plugin is not intercepting purge events.
Menus or forms break after Rocket Loader
Disable Rocket Loader for the affected route or exclude the specific script, then retest. JavaScript that depends on execution order, inline configuration, or immediate DOM availability commonly needs an exclusion.
WooCommerce displays another user’s data
Stop public caching for the affected route immediately, purge edge and origin caches, and inspect cookies and cache rules. Confirm that cart, account, checkout, payment-return, and order pages bypass every cache layer before restoring traffic.
Use Authenticated Origin Pulls for stronger origin protection
Authenticated Origin Pulls (AOP) lets the origin require a client certificate that identifies Cloudflare. Cloudflare requires Full or a higher SSL/TLS mode for AOP. Its global AOP certificate is shared across accounts, so it provides less tenant isolation than a certificate scoped to your zone or hostname.
Use a zone-level or hostname-specific AOP certificate when the origin must distinguish your Cloudflare zone from other Cloudflare customers. Configure the web server to require and validate the chosen certificate, test a direct origin request and a proxied request, and keep a recovery path before enforcing the requirement.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Ongoing maintenance checklist
- Monitor origin certificate expiration and renew before Full (strict) validation fails.
- Review DNS records after adding mail providers, verification services, or subdomains.
- Retest anonymous and authenticated states after WordPress, WooCommerce, theme, plugin, or Cloudflare rule changes.
- Keep cache bypasses for private cookies and transactional paths when adding new features.
- Inspect cache headers after changing page-cache plugins, purge integrations, or cache rules.
- Use a staging or low-risk route for JavaScript deferral and other performance controls.
- Periodically test feeds and
wp-cron.phpso automation is not trapped behind an HTML cache.
Cloudflare describes APO’s benefit as fewer origin round trips and improved time to first byte, but there is no universal percentage improvement. Results depend on the origin server, visitors’ geography, theme, plugins, and how many requests qualify for caching. The safest configuration is the one that produces measurable anonymous-page gains without ever serving private or transactional HTML from a shared edge cache.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
