The best baseline for most WordPress sites is straightforward: put the domain behind Cloudflare, verify DNS and nameservers, use Full (strict) SSL/TLS with a valid certificate at the origin, redirect HTTP to HTTPS, and enable the Cloudflare WordPress plugin with Automatic Platform Optimization (APO) when its eligibility requirements are met. Let anonymous, cacheable HTML use the edge; keep logged-in sessions, administration, carts, checkout, feeds and cron requests out of the public cache.
That arrangement improves delivery by serving eligible pages from Cloudflare locations instead of contacting the origin for every request. It also avoids the most dangerous WordPress caching error: exposing one visitor’s private or transactional HTML to another visitor. The settings and tests below show exactly what to enable, what to leave bypassed and how to verify the result.
As an Amazon Associate I earn from qualifying purchases.
Recommended Cloudflare settings at a glance
| Area | Recommended setting | Reason and qualification |
|---|---|---|
| DNS | Confirm all records, then change the registrar’s nameservers to Cloudflare | Cloudflare must be authoritative for the zone before its proxy and WordPress integrations can operate. |
| SSL/TLS mode | Full (strict) | Use when the origin presents a valid certificate from a public certificate authority or Cloudflare Origin CA. |
| HTTP handling | Redirect HTTP to HTTPS; enable Automatic HTTPS Rewrites if old asset URLs still use HTTP | The redirect secures visitor connections; rewrites repair mixed-content references but do not replace the redirect. |
| WordPress integration | Cloudflare WordPress plugin with a least-privilege API token | The plugin can apply WordPress-specific settings, purge changes and provide APO integration. |
| HTML caching | APO for eligible anonymous GET/HEAD HTML | APO extends edge caching to qualifying dynamic WordPress responses. |
| Bypasses | Logged-in users, administrators, WooCommerce activity, checkout, feeds and wp-cron.php |
These requests can contain private, changing or operational data. |
| JavaScript acceleration | Rocket Loader only after compatibility testing | It defers JavaScript and can affect menus, forms, analytics, consent tools and ecommerce scripts. |
What you need before changing settings
Have administrator access to WordPress, access to the domain registrar, access to the Cloudflare account and a working HTTPS certificate at the origin. If the origin certificate is not yet valid, install a certificate from a public certificate authority or use a Cloudflare Origin CA certificate before selecting Full (strict). Full (strict) validates the certificate; it is not a setting that can repair an invalid, expired or mismatched certificate.
Record the current DNS records before moving nameservers. Include the web host’s A or AAAA records, mail-related records, verification records and any subdomains used by APIs or media. A missing mail record can interrupt email even though the website itself appears healthy. Proxy only the hostnames that should pass through Cloudflare; leave services that must resolve directly in DNS-only mode when their provider requires it.
#1 Best Overall
Put the domain on Cloudflare safely
- Add the domain in Cloudflare. Let Cloudflare import the existing DNS records, then compare the imported zone with the registrar’s current records. Correct omissions before changing nameservers.
- Confirm the authoritative nameservers. Cloudflare provides two nameservers for the zone. At the registrar, replace the old nameservers with those two values. Nameserver propagation can take time; wait until Cloudflare reports the zone as active.
- Check resolution from outside your network. Resolve the apex domain and the
wwwhostname, and confirm that mail and verification records still exist. Do not assume a green Cloudflare status means every subdomain was imported correctly. - Keep a rollback record. Save the previous nameservers and DNS values. If an overlooked record causes an outage, you can restore the former delegation while correcting the zone.
Cloudflare’s APO setup treats DNS confirmation and the nameserver change as prerequisites. Do not start plugin troubleshooting until the zone is active and the website resolves through the intended records.
Install the WordPress plugin and enable APO
On Cloudflare’s free plan, APO is a paid add-on. Pro and higher plans can continue through the plugin setup described in Cloudflare’s documentation. Availability and plan entitlements can change, so the APO control in your account is the authority for the zone.
- In WordPress, open Plugins > Add New, search for the official Cloudflare plugin, install it and activate it.
- In the plugin’s Cloudflare connection screen, choose the option to create or use an API token rather than supplying a global API key.
- Create a token from Cloudflare’s WordPress template. Keep its permissions limited to the zone and actions the plugin requires, then authenticate the plugin with that token.
- Select Apply Recommended Cloudflare Settings for WordPress. Review the resulting settings instead of treating the button as a substitute for testing.
- Enable Automatic Platform Optimization in the plugin or the Cloudflare dashboard when the account shows it as available.
- Clear any existing page-cache plugin’s server cache, then test the site while logged out and logged in.
APO is unsupported for WordPress multisite according to the plugin limitations. A multisite network should not be presented as APO-compatible merely because the single-site plugin can be activated.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose the correct SSL/TLS mode
Cloudflare states: “If possible, Cloudflare strongly recommends using Full or Full (strict) modes to prevent malicious connections to your origin.” The practical choice is determined by what the origin actually serves.
| Mode | Cloudflare-to-origin connection | Use it when | Important limitation |
|---|---|---|---|
| Full (strict) | HTTPS with certificate validation | The origin certificate is valid, unexpired, matches the hostname and is issued by a public CA or Cloudflare Origin CA. | Requests fail if the certificate cannot be validated; fix the origin rather than downgrading permanently. |
| Full | HTTPS without certificate validation | The origin supports HTTPS but its certificate cannot currently be validated. | Use only as a temporary compatibility step and plan to install a valid certificate. |
| Flexible | HTTP | Only as a fallback for an origin that cannot use HTTPS. | The visitor-to-Cloudflare leg is encrypted, but Cloudflare-to-origin traffic is not. |
Set Full (strict) after confirming the origin certificate from the server or hosting panel. If the site loops between HTTP and HTTPS after the change, inspect origin redirects and WordPress’s site URL; do not solve a loop by making the entire zone Flexible.
Force HTTPS and repair mixed content
After SSL/TLS is working, create an HTTP-to-HTTPS redirect so visitors and crawlers receive one canonical URL. Cloudflare’s redirect control can handle the edge redirect; an origin redirect can also be used, but avoid creating two conflicting redirect chains.
Enable Automatic HTTPS Rewrites when legacy image, stylesheet or script references still begin with http://. Rewrites can correct many safe asset references while the page is delivered over HTTPS. They do not replace updating hard-coded URLs in themes, plugins or the WordPress database, and they do not make an insecure third-party script safe. For persistent mixed-content warnings, update the source URL and test the page’s browser console.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Cloudflare is rolling out Automatic SSL/TLS recommendations and says it will not downgrade a domain to a less secure mode. Automatic recommendations still depend on a valid origin certificate; keep that certificate maintained rather than relying on a less secure fallback.
How APO decides whether to cache a WordPress response
APO does not cache every request. Cloudflare describes an eligible request as one that satisfies all of the following conditions:
- The method is
GETorHEAD. - The request has an HTML-eligible
Acceptheader or targets an eligible path. - The origin returns a 200 HTML response.
- WordPress grants edge caching with the
cf-edge-cachepermission. - No bypass cookie is present.
- The request does not ask for no-cache behavior.
- The path is not excluded.
Checkout, wp-cron.php and feeds are examples of excluded paths. A response that misses one condition can correctly go to the origin even when APO is enabled.
For qualifying pages, APO can cache the whole site at the edge, reducing origin round trips and improving time to first byte. Results vary with origin capacity, visitor geography, theme, plugins and the percentage of requests that are actually eligible; there is no universal improvement percentage to apply to every WordPress site.
Keep private and transactional WordPress traffic out of cache
Cloudflare says logged-in and administrator users bypass the cache. Its WordPress performance guidance also describes caching anonymous page views while bypassing WooCommerce activity. Preserve these protections when adding custom rules.
| Request type | Cache treatment | Why |
|---|---|---|
| Anonymous homepage, post or page | Allow APO when the response meets its eligibility rules | These pages are shared public HTML and are the primary edge-cache opportunity. |
| WordPress login, admin and logged-in account pages | Bypass | Responses can contain user-specific data and controls. |
| WooCommerce cart, checkout, account and session requests | Bypass | Cart contents, payment steps and order details are private and change per visitor. |
| Search, preview and other stateful endpoints | Bypass unless you have explicitly validated their behavior | Query-specific or preview content can be incorrectly shared if cached broadly. |
Feeds and wp-cron.php |
Keep excluded | They are operational or feed endpoints, not ordinary anonymous page views. |
Never remove a bypass simply because a cache test reports a faster response. A public cache HIT is a failure if it contains another visitor’s account, cart or checkout information.
APO versus manual cache rules
APO is the simpler choice when you want Cloudflare’s WordPress integration to identify common bypass cookies and purge changed content. Manual Cache Rules are useful when the site has unusual paths, query-string requirements or a need for explicit operational control. Cloudflare recommends Cache Rules over legacy Page Rules for enhanced configurability.
| Decision point | APO | Manual Cache Rules |
|---|---|---|
| Eligibility | Uses WordPress-aware eligibility, including request method, HTML response and bypass conditions. | You define host, path, query and cache behavior; WordPress awareness must be supplied by your rules. |
| Cookies and sessions | Designed to bypass logged-in and commerce activity through the plugin’s integration. | Requires carefully maintained cookie and path exclusions. |
| Purge behavior | The WordPress plugin can notify Cloudflare when content changes; Cloudflare’s FAQ says cached content is automatically invalidated within 30 seconds when the plugin is installed. | You control purge triggers and scope, but an incomplete purge rule can leave stale pages. |
| TTL and operation | Cloudflare’s FAQ says APO automatically caches content for 30 days; separate Edge Cache TTL page rules are generally unnecessary, although existing cache rules can still affect APO. | Offers more direct control over TTL, query strings and excluded paths. |
| Plugin overlap | Works best when another page-cache layer is not rewriting the same headers and purge instructions. | Can coexist with a page cache only after headers, bypasses and purges are deliberately coordinated. |
| Cost | APO is a paid add-on on the free plan; plan availability determines access. | Uses the Cloudflare features available to your account, with no APO entitlement implied. |
| Observability | Provides APO-related response headers that reveal eligibility and cache outcome. | Provides rule and cache headers, but interpretation depends on your custom configuration. |
Do not stack page-cache systems blindly
During initial APO setup, Cloudflare recommends turning off WP Rocket, W3 Total Cache or similar page-cache plugins. Clear the other plugin’s server cache after APO activation. Then test APO by itself before re-enabling another page cache.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Re-enable a second cache only if you can identify which layer owns each responsibility. Two systems that both rewrite cache-control headers, create page variants or issue purges can produce stale HTML, redirect loops, inconsistent compression or pages that never reach the edge. Keep one source of truth for public HTML while you investigate.
Performance controls beyond APO
Image optimization
Cloudflare’s WordPress support guidance places image controls under Speed > Settings > Image Optimization. Configure image features there only after checking that your theme and existing media workflow do not already transform the same files. Test responsive images, lazy loading and prominent above-the-fold media on representative pages.
Rocket Loader
Rocket Loader defers JavaScript. Apply it on a staging site or low-risk page first, then test navigation menus, forms, analytics, consent tools and ecommerce scripts. A page that renders visually can still be broken if a deferred script fails to initialize checkout validation or a consent state.
Rank #4
Browser Integrity Check
Browser Integrity Check is another available configuration-rule setting. Treat it as a security control, not a caching feature, and monitor legitimate automated clients or integrations that may be challenged.
Recommended Free Tools
Verify caching with response headers
Use a request that advertises HTML and inspect the response headers. For example:
curl -I -H "Accept: text/html" https://example.com/Replace the hostname with your site. Cloudflare’s WordPress.com instructions identify these headers as the useful signals:
cf-cache-status: HITmeans the response was served from cache.cf-apo-via: cacheindicates APO handled it through cache.cf-edge-cache: cache,platform=wordpressindicates WordPress granted edge caching.
A first request can be a MISS while Cloudflare fills the cache. Repeat the same anonymous request, preferably from a separate network or after the documented cache-fill interval, and inspect the headers again. Do not treat a HIT on a private URL as success.
Run a state-by-state test plan
- Anonymous homepage: open a private browser window, load the homepage twice and inspect the headers. A HIT is expected only if the response is eligible.
- Anonymous post: test a normal article and confirm that its HTML, images and theme scripts render correctly from cache.
- Logged-in dashboard: sign in and open the dashboard and an account page. These responses should bypass public cache.
- WooCommerce cart and checkout: add an item, change quantity, enter checkout and verify that each state remains tied to the current session.
- Feed: request a feed URL and confirm it remains on the intended origin or bypass path rather than being treated as ordinary page HTML.
wp-cron.php: trigger or request the endpoint and verify that scheduled tasks still run; it should not be publicly cached.- HTTPS and assets: load key templates, inspect the browser console for mixed-content errors and test redirects from both the apex and
wwwhostnames if both are configured.
Troubleshoot the common failure modes
Full (strict) produces an SSL error
Check that the origin certificate is unexpired, covers the requested hostname and is served with the complete certificate chain. Confirm the web server presents that certificate to Cloudflare, then retry Full (strict). Use Full only as a temporary bridge while the certificate is corrected.
Every request is a MISS
Check the method, Accept header, response status and content type. Look for bypass cookies, a no-cache request, an excluded path, a non-200 response or missing cf-edge-cache permission. Confirm that another plugin or server layer is not adding private cache headers.
Best Value
- Used Book in Good Condition
Anonymous visitors see stale or personalized HTML
Immediately purge the affected cache, disable overlapping page-cache layers and inspect cookies and vary behavior. Verify that logged-in, account, cart and checkout paths are bypassed. Do not re-enable broad caching until a logged-out and logged-in test shows separate behavior.
WooCommerce actions fail after caching is enabled
Restore bypasses for cart, checkout, account, session and any AJAX or API endpoint used by the theme. Test add-to-cart, quantity changes, coupon application, payment validation and order confirmation as separate flows.
Menus or forms stop working after Rocket Loader
Disable Rocket Loader for the affected path or script, then retest. Identify the script that depends on execution order before considering a narrower exclusion or a site-wide rollout.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Changes do not appear immediately
Use the WordPress plugin’s purge mechanism and clear the separate page-cache plugin’s server cache if one remains enabled. Cloudflare’s FAQ states that APO invalidates changes within 30 seconds when the plugin is installed, but browser, origin and other plugin caches can still display older content.
Protect the origin with Authenticated Origin Pulls
Authenticated Origin Pulls (AOP) lets the origin require a client certificate from Cloudflare. Cloudflare requires Full or a higher SSL/TLS mode for AOP. Global AOP uses a Cloudflare-provided certificate shared across accounts; choose a zone-level or hostname-specific certificate when stronger isolation between services is needed. Configure the origin web server to trust the intended certificate and test direct-origin access separately, because an incorrectly enforced certificate can block legitimate maintenance traffic.
A practical rollout order
- Inventory DNS, origin HTTPS, WordPress paths and commerce or membership features.
- Activate Cloudflare and verify nameservers and DNS records.
- Install the plugin, create its least-privilege token and apply the recommended WordPress settings.
- Set Full (strict), establish the HTTPS redirect and repair remaining mixed-content URLs.
- Disable overlapping page-cache plugins and clear their server caches.
- Enable APO, then test anonymous, logged-in, commerce, feed and cron states.
- Inspect
cf-cache-status,cf-apo-viaandcf-edge-cacheon repeated anonymous HTML requests. - Only after the baseline is stable, test Image Optimization, Rocket Loader, custom Cache Rules or AOP one change at a time.
This sequence gives you a known-good baseline and makes a later regression traceable to one change instead of several interacting cache and security layers.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
