Cloudflare is a global network that acts as an intermediary between your server and users. Traffic passes through the nearest Cloudflare data center (300+ points of presence), which speeds up loading and filters malicious requests before they reach your server.
What Cloudflare Does
- CDN — caches static content on servers around the world
- DDoS protection — automatically blocks attacks up to terabit volumes
- DNS — fast authoritative DNS with a TTL starting at 1 minute
- SSL/TLS — free HTTPS without a certificate on the server
- Firewall — blocking rules by IP, country, User-Agent
- Optimization — JS/CSS/HTML minification, image compression
Cloudflare Plans
| Plan | Price | Key features |
|---|---|---|
| Free | $0 | CDN, DDoS L3/L4, SSL, basic WAF, 3 Page Rules |
| Pro | $20/mo | WAF OWASP, Image Optimization, 20 Page Rules |
| Business | $200/mo | Custom WAF, 100% SLA, PCI DSS |
| Enterprise | On request | Dedicated IPs, custom protection |
✅ The free Cloudflare plan is enough for most sites: CDN, SSL, and basic DDoS protection work with no traffic limits.
How Cloudflare Speeds Up a Site
- The user requests example.com
- DNS returns the IP of the nearest Cloudflare POP
- Cloudflare serves cached content (static assets) without contacting the server
- Dynamic requests are proxied to your server over an optimized channel
The Server's Real IP Is Hidden
When your domain is connected to Cloudflare in "Proxied" mode (orange cloud), the server's real IP is not visible in DNS. This makes direct DDoS attacks on your server harder.
⚠️ Don't publish the server's real IP anywhere — in email headers, on other domains without Cloudflare, in SPF records. Otherwise attackers will find it and bypass the protection.
Common Connection Errors
| Error | Cause | Fix |
|---|---|---|
| Error 521: Web Server Is Down | Cloudflare cannot reach the server — the web server is down or a firewall is blocking Cloudflare's IPs | Confirm Nginx/Apache is running and allow Cloudflare's IP ranges in the firewall |
| Error 522: Connection Timed Out | The server doesn't respond in time — it's overloaded or port 80/443 is closed | Check server load and the iptables/ufw rules for ports 80 and 443 |
| Error 525: SSL Handshake Failed | A TLS connection between Cloudflare and the origin server could not be established | Check the SSL certificate's validity on the server and the SSL/TLS mode in Cloudflare |
| ERR_TOO_MANY_REDIRECTS in the browser | SSL/TLS mode is "Flexible" while the server itself redirects HTTP to HTTPS — this creates a loop | Switch the mode to "Full" or "Full (strict)" under SSL/TLS |
| SSL_ERROR_RX_RECORD_TOO_LONG in the browser | Port 443 on the server is still serving plain HTTP instead of the HTTPS Cloudflare expects | Set up valid HTTPS on the origin server, or temporarily switch the mode to "Flexible" |
Comparing Cloudflare With Alternatives
| Option | CDN | DDoS protection | Entry cost |
|---|---|---|---|
| Cloudflare (Free) | Yes, 300+ points of presence | Included with no traffic limits | Free, only requires changing NS servers |
| Direct connection, no CDN | None | Only what the host provides | No setup needed, but the server is directly exposed |
| Another CDN (e.g. BunnyCDN) | Yes, billed by traffic | Basic, no dedicated WAF on the free tier | From a few cents per GB of traffic |
When Cloudflare Is Not a Good Fit
- The application needs long-lived WebSocket connections with complex routing — the free plan can drop them, and stability requires an Enterprise plan
- Regulatory requirements forbid routing traffic through third-party infrastructure outside a given jurisdiction — Cloudflare simply won't work here
- Full control over TLS termination and custom ciphers at the network edge is required — proxying through Cloudflare doesn't allow that
- The site already sits behind another CDN or load balancer, and stacking a second proxy layer only makes troubleshooting harder
A step-by-step domain setup is covered in "Connecting a Site to Cloudflare: A Step-by-Step Guide", and DDoS protection details are in "Cloudflare DDoS Protection: How It Works and Setup".
Verifying the Result
After connecting the domain, confirm traffic actually flows through Cloudflare:
# The domain's NS servers should be Cloudflare's
dig NS example.com +short
# The cf-ray header confirms proxying through Cloudflare
curl -sI https://example.com | grep -i "cf-ray"
# Check the real IP in the response headers (should not match the origin)
curl -sI https://example.com | grep -i "server"
# The SSL certificate should be issued for the domain, not self-signed
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -issuerIf you need server access with no open ports at all, the next step is "Cloudflare Tunnel: local server access without a public IP".