Quick answer
To set up Cloudflare for WordPress: create a Cloudflare account, add your domain, update your domain's nameservers to Cloudflare's, enable SSL (Full/Strict), turn on the WAF and bot protection, and add rate-limiting rules for wp-login.php and xmlrpc. This puts a security and caching layer in front of your site.
Key takeaways
- Cloudflare sits in front of your site, filtering attacks and caching content.
- Rate-limiting wp-login.php and xmlrpc blocks the most common WordPress attacks.
- Use Full (Strict) SSL so the connection is encrypted end to end.
Cloudflare is one of the easiest ways to add a serious security and performance layer in front of your WordPress site — much of it free. Here's how to set it up so it actually protects you.
1. Add your domain to Cloudflare
Create an account, add your domain, and let Cloudflare scan your existing DNS records. Review them for accuracy.
2. Update your nameservers
Point your domain's nameservers to the ones Cloudflare provides. This routes your traffic through Cloudflare's network, where the protection happens.
3. Set SSL to Full (Strict)
This encrypts the connection end to end — between the visitor and Cloudflare, and between Cloudflare and your server. Avoid the "Flexible" setting, which leaves part of the path unencrypted.
4. Turn on the WAF and bot protection
Enable the web application firewall and bot-fight features to block common attacks and malicious crawlers at the edge.
5. Rate-limit the WordPress attack surface
Add rules to rate-limit or challenge requests to wp-login.php and xmlrpc.php — two of the most attacked WordPress endpoints. That single step blocks a large share of automated attacks.
Free security check
Worried your site is infected?
Get a free security assessment — I'll tell you if your WordPress site is compromised and exactly what it needs. No obligation.
Follow-up questions
People also ask
Cloudflare's free plan covers DNS, SSL, caching, and basic security for most sites. Paid plans add advanced WAF rules and more granular controls.
Keep reading
How to Recover Your Google Rankings After a Hack
A hack can tank your search rankings. Here's how to recover them once the site is clean.
WordPress Security for Small Businesses: A Practical Guide
You don't need an IT team to secure a small-business WordPress site. Here's a practical, no-jargon plan that covers the essentials.
How to Secure a WooCommerce Store
A WooCommerce store handles money and customer data, which makes it a target. Here's how to secure it without hurting sales.