Why every client website ends up behind Cloudflare

Your website is the only asset you own that you actively invite strangers to interact with. It sits on the public internet, it runs software you did not write, and it is the first thing a prospective customer sees. That combination is why we end up putting essentially every client site behind Cloudflare.

Here is what that actually does, and just as importantly, what it does not.

What the edge stops before it reaches your host

Volumetric attacks

Small business sites are rarely targeted deliberately. They are much more often collateral in automated floods, or taken down by a badly-behaved scraper hammering a search page until the hosting plan's resource limits kick in. Absorbed at the edge, that traffic never becomes an outage — and never becomes an overage bill either.

The exploit scanners

A managed web application firewall ruleset covers the common injection and exploit paths, which matters most for platforms with a large plugin surface. Every WordPress site on the internet is scanned continuously by tooling probing for known-vulnerable plugin versions. The WAF answers most of that before your host wakes up.

The bots filling in your forms

Contact form spam is almost never people. Bot management and a managed challenge separate automated traffic from real visitors without putting a puzzle in front of a customer trying to get in touch.

Brute force on the login page

Rate limiting on login and form endpoints, which is where credential stuffing actually happens. Cheap to configure and it removes a whole category of noise.

The part clients notice

Not the security. The speed.

Static content served from an edge location close to the visitor rather than from a single origin server usually shows up as a visibly faster site, particularly on mobile and particularly for visitors outside the capital city your host sits in. Certificates are issued and renewed automatically, which quietly removes the annual outage where somebody forgets to renew one.

What it does not do

This is the honest part, and it is why we do not sell it as a security solution on its own.

A firewall in front of an unpatched content management system buys you time, not safety. If your site runs WordPress, the plugins still need updating, the admin login still needs multi-factor authentication, and the backups still need to exist somewhere the web server cannot reach. A WAF raises the bar; it does not remove the vulnerability underneath.

It also does not protect the origin if the origin is directly reachable. If someone can find your host's IP address and connect to it, they can walk around the edge entirely. Locking the origin down to accept traffic only from Cloudflare is part of doing this properly, and it is the step most self-serve setups skip.

The mistake that turns five minutes into an afternoon

The SSL/TLS encryption mode.

Set it to Full (strict) where your origin has a valid certificate. If you leave it on Flexible, Cloudflare talks to your origin over plain HTTP while telling the browser the connection is secure. On a site that redirects HTTP to HTTPS, that produces an infinite redirect loop, and the symptom — a site that worked five minutes ago now showing ERR_TOO_MANY_REDIRECTS — sends people straight back to undoing the whole migration.

Flexible is also, on its own terms, a lie to the visitor. The padlock says encrypted; the last hop is not.

Before you cut over

Cloudflare imports your existing DNS when you add a domain, and it is usually accurate. Usually is not always, and the records it misses are the ones that hurt:

• MX records — get these wrong and mail stops the moment nameservers switch
• DKIM selector CNAMEs — selector1._domainkey and selector2._domainkey, the pair most often dropped
• SPF and DMARC TXT records
• autodiscover, and the Teams SRV records if you use them

Anything mail-related stays DNS only — grey cloud, not orange. Proxying applies to web traffic; pointing it at a mail host achieves nothing useful and can break things.

Verify every record against the old zone before you change nameservers, then send a test message both directions afterwards. That one habit is the difference between a routine migration and a very bad morning.

Is the free tier enough?

For most small business brochure sites, genuinely yes. DDoS protection, universal SSL, CDN caching, DNS and the basic firewall rules are all included, and we will tell you when your traffic or your risk profile warrants more rather than defaulting you onto a paid plan.