Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
For most WordPress sites, the best Cloudflare configuration is: point the domain to Cloudflare, use Full (strict) SSL/TLS with a valid origin certificate, force HTTPS, and enable the Cloudflare WordPress plugin with Automatic Platform Optimization (APO). Let Cloudflare cache anonymous pages while bypassing logged-in accounts, administrators, WooCommerce sessions, checkout, feeds, and other transactional requests.
Set up one caching layer at a time, verify the response headers from both public and private URLs, and only then add optional features such as Rocket Loader or custom Cache Rules. This approach improves delivery without exposing personal, cart, or checkout content at the edge.
The recommended baseline configuration
Use this as the starting point for a conventional single-site WordPress installation:
- DNS: Add and verify the required records in Cloudflare, then replace the registrar’s nameservers with the two nameservers Cloudflare assigns.
- Encryption: Select Full (strict) when the origin server presents a valid certificate from a public certificate authority or a Cloudflare Origin CA certificate.
- HTTPS: Redirect HTTP requests to HTTPS. Enable Automatic HTTPS Rewrites only as a repair for legacy HTTP asset URLs; it is not a substitute for the redirect.
- WordPress integration: Install the Cloudflare WordPress plugin, authenticate it with a least-privilege API token, apply the recommended WordPress settings, and enable APO.
- Cache scope: Cache eligible anonymous GET and HEAD HTML responses. Keep bypasses for logged-in users, administrators, carts, checkout, account pages, feeds,
wp-cron.php, and any other private or state-changing endpoint. - Other cache plugins: Disable overlapping page-cache plugins during APO setup. After testing, re-enable one only if it provides a measured benefit without conflicting headers or purge behavior.
Cloudflare does not publish one universal percentage improvement for this configuration. The result depends on origin performance, visitor geography, theme, plugins, and how much traffic is cacheable.
#1 Best Overall
Prepare the site before changing Cloudflare
Confirm the origin works without Cloudflare changes
Log in to WordPress, open the public homepage and a representative post, and confirm that the origin serves valid HTTPS. Fix certificate errors, redirect loops, broken canonical URLs, and mixed-content warnings before enabling edge caching. A cache can preserve a bad response and make diagnosis harder.
Inventory private and transactional URLs
Write down paths that must never be delivered from a shared public cache. Typical examples include:
/wp-admin/and the WordPress login endpoint/wp-login.php, password-reset pages, and account dashboards- WooCommerce cart, checkout, account, order, and payment-return pages
- Membership, subscription, search, preview, and personalized pages
- Feeds, webhooks, API endpoints, and
/wp-cron.php
Plugins can add their own cookies and paths. Check each plugin’s documentation and test its logged-in and anonymous states rather than assuming that a generic bypass list covers it.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsPlan a low-risk test window
Have a staging site or a quiet period available for testing menus, forms, analytics, consent tools, search, comments, media, and ecommerce. Keep an administrator session open in a separate browser so you can immediately disable a problematic rule.
Onboard the domain and install the WordPress plugin
1. Verify DNS and nameservers
- Add the domain to Cloudflare.
- Review every imported DNS record. Confirm the web host’s A or AAAA record,
wwwalias, mail records, verification records, and any service-specific records are present and accurate. - At the registrar, replace the existing nameservers with the pair Cloudflare provides.
- Wait for the registrar and DNS changes to propagate, then confirm that Cloudflare reports the zone as active.
Do not proxy mail, database, SSH, or other services that are not designed to accept Cloudflare’s HTTP proxy. Keep those records DNS-only where appropriate.
2. Install and authenticate the plugin
- In WordPress, open Plugins > Add New Plugin, search for the official Cloudflare plugin, install it, and activate it.
- Create a least-privilege Cloudflare API token from the WordPress template. Use a token rather than a broad account key, and store it outside public repositories and shared notes.
- Authenticate the plugin, select the correct Cloudflare account and zone, and choose Apply Recommended Cloudflare Settings for WordPress.
- Enable APO in the plugin after the zone and DNS are active.
On the free plan, APO is a paid add-on. Pro and higher plans can continue through the plugin setup according to Cloudflare’s current documentation; the exact price or entitlement is not stated here. WordPress multisite is listed as unsupported for APO, so do not assume the single-site workflow applies to a network installation.
3. Establish one cache authority
During initial APO setup, turn off WP Rocket, W3 Total Cache, or another page-cache plugin that rewrites cache headers or maintains its own purge system. Clear the other plugin’s server cache after APO is active. First prove that Cloudflare’s cache behaves correctly; then test one re-enabled plugin at a time.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Choose the correct SSL/TLS mode
| Mode | Cloudflare-to-origin connection | When to use it | Main risk or limitation |
|---|---|---|---|
| Full (strict) | HTTPS with certificate validation | The origin has a valid public-CA or Cloudflare Origin CA certificate | Fails until the origin certificate, hostname, and chain are correct |
| Full | HTTPS without validating the origin certificate | Temporary compatibility when the origin supports HTTPS but its certificate cannot yet be validated | Plan to replace the certificate; the origin identity is not verified |
| Flexible | HTTP from Cloudflare to the origin | Only as a short-term compatibility fallback | The origin leg is unencrypted and can create redirect loops or insecure application assumptions |
Cloudflare strongly recommends Full or Full (strict) when possible. Full (strict) is the target setting for a production WordPress site because it encrypts and validates both legs of the connection.
Fix certificates before forcing strict mode
Install a certificate that covers the exact hostname Cloudflare uses at the origin, including any needed www name. Confirm that the server sends the intermediate chain and that its system clock is correct. If strict mode reports an origin certificate error, fix the origin rather than downgrading permanently to Flexible.
Redirect HTTP and repair old asset URLs
After HTTPS works, enable the HTTP-to-HTTPS redirect in Cloudflare or at the origin, but avoid enabling two competing redirect mechanisms that produce loops. Turn on Automatic HTTPS Rewrites when old database or theme URLs still reference HTTP images, scripts, or stylesheets. Rewrite support helps mixed-content assets; it does not replace updating WordPress’s site URL and correcting hard-coded links.
Cloudflare is rolling out Automatic SSL/TLS recommendations and says it will not downgrade a domain to a less secure mode. Keep the origin certificate valid if you use automatic recommendations.
How APO decides what to cache
APO extends edge caching to eligible dynamic WordPress HTML instead of caching only static files. A request generally must satisfy all of these conditions:
- It uses GET or HEAD.
- The
Acceptheader or URL is eligible for HTML. - The origin returns a 200 HTML response.
- The response grants WordPress edge-cache permission through
cf-edge-cache. - The request has no bypass cookie and does not send a no-cache instruction.
- The path is not excluded by Cloudflare or your rules.
Checkout, wp-cron.php, and feeds are examples of excluded paths. Cloudflare states that APO automatically caches content for 30 days and invalidates changes within 30 seconds when the WordPress plugin is installed. Existing cache rules can still affect APO, so review them before adding new rules.
What should be cached
- Anonymous homepages, landing pages, category pages, and ordinary posts or pages.
- Public HTML that is identical for visitors regardless of account, cart, location, or experiment state.
- Static assets such as stylesheets, scripts, fonts, and images, subject to your normal versioning and security practices.
What must bypass the cache
- Logged-in users and administrators.
- Any response containing a personal profile, account data, order details, nonce, cart, or checkout state.
- WooCommerce sessions and other commerce activity, while leaving anonymous product and content views cacheable where compatible.
- Search results, previews, form submissions, webhooks, feeds, APIs, and scheduled-task endpoints.
Never solve a cache miss by removing a bypass cookie without testing. A public cache HIT is not a success if it serves one customer’s account or cart HTML to another customer.
APO versus manual Cloudflare cache rules
APO is the safer default for most WordPress sites because the plugin communicates WordPress-specific cache permission and purge events. Manual Cache Rules are useful when you need explicit control over paths, query strings, headers, or non-WordPress applications.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match| Decision factor | APO with the WordPress plugin | Manual Cache Rules |
|---|---|---|
| Eligibility | Uses WordPress-aware HTML eligibility, cookies, response status, and excluded paths | You define matching expressions, cache settings, and exclusions |
| Bypass handling | Automatically bypasses logged-in and administrator sessions and honors WordPress edge-cache signals | Requires you to identify cookies, paths, and headers correctly |
| Invalidation | Plugin-driven invalidation; Cloudflare states changes are invalidated within 30 seconds with the plugin installed | Depends on your purge rules, deployment hooks, and manual or API purges |
| WooCommerce compatibility | Designed to cache anonymous views while bypassing commerce activity, subject to plugin testing | Works only if cart, checkout, account, and session exclusions are complete |
| Plugin overlap | Can conflict with another page cache that rewrites headers or purge behavior | Can also conflict with origin cache plugins unless one system is authoritative |
| Plan cost | Free plan: APO is a paid add-on; Pro and higher plan details are not stated here | Plan availability and any applicable limits depend on the Cloudflare plan; price is not stated here |
| Observability | Supports headers such as cf-apo-via and cf-edge-cache |
Primarily observed through standard cache headers and your rule matches |
| Query-string and path control | Opinionated WordPress behavior with existing rules still able to influence results | Greater control, with greater risk of caching private or stale responses |
Use Cache Rules rather than legacy Page Rules when you need enhanced configurability. Do not create a broad “cache everything” rule over WordPress unless you have explicitly excluded every private and transactional state.
Configure performance features cautiously
Image Optimization
Cloudflare’s WordPress support guidance places image controls under Speed > Settings > Image Optimization. Enable only the formats and transformations your theme and media workflow support, then inspect responsive images, lazy loading, and social previews on a staging or low-risk page.
Rocket Loader
Rocket Loader defers JavaScript. Test navigation menus, forms, analytics, consent managers, payment widgets, sliders, and any script that depends on execution order before applying it site-wide. Exclude a script or disable the feature when a measurable browser error appears; a faster first paint is not worth a broken checkout or inaccessible menu.
Browser Integrity Check and configuration rules
Rocket Loader, Automatic HTTPS Rewrites, and Browser Integrity Check are available as configuration-rule settings. Apply changes to a narrow path or hostname first, record the result, and expand only after confirming normal visitor and administrator workflows.
Verify caching with headers and real user states
Inspect a public HTML response
Request the page with an HTML Accept header and inspect the response headers in browser developer tools or with a command-line request such as:
curl -I -H 'Accept: text/html' https://example.com/Replace the example hostname with your own site. The most useful indicators are:
| Header | Expected eligible result | What it tells you |
|---|---|---|
cf-cache-status |
HIT after the object is warmed |
Cloudflare served the response from edge cache |
cf-apo-via |
cache |
APO handled the response through its cache path |
cf-edge-cache |
cache,platform=wordpress |
WordPress granted edge caching for the response |
A first request can be a MISS while Cloudflare fills the cache. A MISS, BYPASS, or DYNAMIC response is valid for private, excluded, uncachable, or not-yet-warmed requests.
Run the minimum state matrix
- Open the anonymous homepage in a fresh private window and inspect the headers.
- Open an anonymous post or page and confirm that its HTML behaves consistently.
- Sign in as an administrator and verify that the dashboard and front-end account state are never publicly cached.
- Add an item to a WooCommerce cart, open checkout, and complete a test payment flow in a safe environment.
- Request a feed and
wp-cron.php; confirm that they remain excluded or dynamic as designed. - Publish or edit a test post, purge if necessary, and verify that the new content appears within the expected invalidation window.
Test from more than one network or region when your audience is geographically distributed. Edge state can differ by location, and a single browser reload cannot prove global behavior.
Free tools Windows power users keep installed
One-click scans. No signup required.
Troubleshoot the common failure modes
The page never becomes a cache HIT
- Check that the request is GET or HEAD and advertises HTML.
- Look for a bypass cookie, a
Cache-Control: no-cacherequest, a non-200 response, or a path excluded by APO. - Confirm the WordPress plugin is active and that the response includes the expected
cf-edge-cachepermission. - Review existing Cache Rules, Page Rules, origin headers, and another page-cache plugin for conflicting directives.
Visitors see stale or wrong content
- Immediately purge the affected Cloudflare object and the origin page-cache object.
- Check whether a logged-in, cart, account, or personalization cookie was omitted from bypass logic.
- Remove broad cache-everything rules and narrow the match to anonymous HTML.
- Confirm that publishing hooks and the WordPress plugin can reach Cloudflare to invalidate changes.
HTTPS redirect loops or certificate errors appear
- Use Full (strict) only after the origin certificate validates for the requested hostname.
- Check whether both the origin and Cloudflare are redirecting in incompatible ways.
- Remove Flexible mode once the origin supports HTTPS.
- Update WordPress Address and Site Address to HTTPS and repair hard-coded HTTP resources.
Menus, forms, or checkout break after Rocket Loader
Disable Rocket Loader for the affected path or script, clear the relevant caches, and retest with browser console errors visible. If the feature changes script order, leave it off for that site rather than weakening payment or form logic.
The site is a multisite network
APO is documented as unsupported for WordPress multisite. Use carefully scoped, manually tested caching rules and preserve all network, login, preview, and tenant-specific bypasses instead of applying the single-site APO procedure.
Protect the origin with Authenticated Origin Pulls
Authenticated Origin Pulls (AOP) lets the origin require a Cloudflare client certificate, helping ensure that HTTPS requests reaching the server came through Cloudflare. Full or a higher SSL/TLS mode is required.
Global AOP uses a Cloudflare-provided certificate shared across accounts. For stronger isolation, use a zone-level or hostname-specific certificate and configure the origin to trust that certificate. Roll out AOP on a test hostname first, because an incorrect web-server trust rule can block every request, including administrator access.
Operate the configuration safely
- Record the current SSL mode, DNS records, Cache Rules, bypass patterns, plugin settings, and origin certificate expiry date.
- Change one feature at a time and keep a rollback path for every rule.
- After plugin, theme, WooCommerce, consent, analytics, or payment changes, repeat the anonymous, logged-in, cart, checkout, feed, and cron tests.
- Monitor cache status, origin errors, redirect responses, and support tickets for symptoms of private-data leakage or stale content.
- Review certificates before expiry and keep Full (strict) as the production target.
- Periodically remove obsolete rules and cache plugins so that one clearly owned system controls headers and purges.
The practical goal is not to maximize the number of cache hits. It is to cache public HTML confidently, keep private and transactional responses out of shared storage, and maintain a verifiable HTTPS path from visitor to origin.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
