What is Cloudflare? Website benefits, SSL modes, and WordPress settings

Cloudflare is a reverse proxy and content delivery network (CDN) service that takes over DNS for a domain and routes web traffic through its own network between visitors and the server. Visitors connect to the website through a nearby Cloudflare data center rather than directly to the server; static files can be cached there, suspicious requests filtered before reaching the server, and certificate management simplified.

The practical side of “what is Cloudflare” lies in its settings. Correctly configured, the same service reduces server load and improves security, while an incorrect SSL mode or overlooked DNS record can make the website completely unavailable or stop email. This article explains how Cloudflare works, its benefits, differences between SSL/TLS modes, WAF and caching logic, and considerations for WordPress websites, based on Cloudflare’s own developer documentation.

What is Cloudflare, and how does it work?

When a domain’s nameservers point to Cloudflare, it becomes the authoritative DNS provider for that domain and returns its own anycast IP addresses instead of the server’s actual IP for proxied records. HTTP and HTTPS requests from browsers therefore reach the Cloudflare network first and are forwarded to the original server (origin) if needed.

The official document describing how Cloudflare works defines two roles for this structure: authoritative DNS provider and reverse proxy. After adding the domain to the dashboard, protection appears as “pending” until the nameserver change is verified; the document says verification can take up to 24 hours. The website remaining with its hosting company and email and files staying in place during the transition also follow from this architecture: only the traffic path changes.

What benefits does Cloudflare provide for a website?

Cloudflare’s contributions fall under speed, security, and management convenience; which stands out depends on the website’s structure and settings. Benefits to expect from a correctly configured setup include:

• Serving static files from nearby: Files such as images, CSS, and JavaScript can be cached in Cloudflare data centers; visitors receive them without reaching the server.
• Reducing server load: Every request served from cache removes one request the hosting server needs to process.
• Hiding the real IP: For proxied records, the server address is not exposed externally; targeted attacks hit Cloudflare’s network first.
• DDoS protection: For proxied records, network-level protection against excessive traffic attacks takes effect.
• Edge certificate: Cloudflare provides the certificate for the connection between the visitor and Cloudflare.
• Rule-based control: WAF rules, redirect rules, and cache rules are managed from one dashboard.

None of these benefits automatically means a ranking advantage or a particular speed score. If slowness originates from a heavy theme, bloated database, or inadequate server, Cloudflare hides the problem but does not solve it; uncached HTML pages in particular remain dependent on server speed.

DNS proxy: The difference between the orange and gray clouds

Each DNS record in the Cloudflare dashboard has a proxy status: an orange cloud (Proxied) means traffic passes through Cloudflare, while a gray cloud (DNS only) means Cloudflare only reports the server’s real IP address. According to the proxy status documentation, only A, AAAA, and CNAME records used for IP resolution can be proxied; other types such as MX and TXT always remain DNS only.

This distinction frequently causes email errors: if the A record of a subdomain such as “mail” pointing to the mail server is orange-clouded, email applications may be unable to connect because Cloudflare carries only web traffic. CNAME records added for domain verification must also not be proxied.

A web record left gray-clouded has a different cost: that subdomain exposes the server’s actual IP address to everyone, and Cloudflare cannot perform HTTP analysis for that traffic. Proxied records have a fixed “Auto” TTL that cannot be changed manually.

CDN and caching: What is stored on edge servers?

By default, Cloudflare caches files according to their extensions and does not cache HTML pages; out of the box, it therefore speeds up images, stylesheets, scripts, and fonts. The default cache behavior documentation lists common extensions including JPG, PNG, WEBP, AVIF, CSS, JS, WOFF2, and PDF.

Headers sent by the server also determine whether an edge server stores a file. If Cache-Control is private, no-store, no-cache, or max-age=0, or if the response contains a Set-Cookie header, Cloudflare does not store that response; requests other than GET are also not cached.

To store HTML at the edge too, a separate Cache Rules rule must be written. If done carelessly, this can cause serious errors such as displaying pages specific to a logged-in user or shopping cart to someone else. When old files remain visible after updates, the cache is purged individually by URL or all at once.