Cloudflare Setup Guide for WordPress: Free CDN, SSL and Security (2026)

Cloudflare’s free plan puts a global CDN, free SSL and basic DDoS protection in front of your WordPress site. Done carefully, it takes about 30 minutes. Done carelessly, it can break your email. Here is the safe way.

From my own work: When I move sites behind Cloudflare, the most common problem is missing email records after the nameserver change. I always copy MX, SPF, DKIM and DMARC records first and send a test email afterwards.

Why use Cloudflare?

• Speed: static files are served from data centres near your visitors.
• Security: DDoS protection, a basic firewall and bot filtering.
• Free SSL at the edge and hidden server IP.

1. Add your site

Create a Cloudflare account, choose Add a site, enter your domain and pick the Free plan (docs). Cloudflare scans your existing DNS records.

2. Review DNS records carefully

Compare the imported list with your current DNS at the registrar. Make sure these exist:

3. Change nameservers

At your registrar (Namecheap, GoDaddy and so on) replace the nameservers with the two Cloudflare gives you (guide). Activation usually takes minutes to a few hours.

4. Set SSL correctly

Keep a valid certificate on your server (for example Let’s Encrypt) and set SSL/TLS mode to Full (strict) (SSL modes). Avoid “Flexible” with WordPress; it often causes redirect loops. Turn on Always Use HTTPS.

5. Caching and security settings

• Leave default caching for static files (default behaviour); do not cache /wp-admin, login, cart or checkout.
• Enable Brotli and HTTP/3.
• Set Bot Fight Mode carefully if you use uptime monitors or APIs.
• Purge the Cloudflare cache after big design changes, together with your WordPress cache.

6. Test everything

1. Open the site in a private window and check HTTPS works.
2. Log in to wp-admin and save a post.
3. Submit your contact form.
4. Send and receive a test email on your domain.
5. Re-run PageSpeed; see other speed fixes.

Need help with this on your own site or business?

I build and secure WordPress sites, web apps and AI automations end to end, in Bangla and English: a free discovery call, a written scope with a fixed quote, a focused first version, then testing, deployment and monitoring.

See the portfolio and the AI agent services, or tell me what you need.

FAQ

Is Cloudflare free plan enough for WordPress?

For most small and medium sites, yes: CDN, SSL and basic protection are included.

Will Cloudflare break my email?

Only if MX, SPF or DKIM records are missing after the nameserver change, or mail records are proxied. Keep them DNS only.

Do I still need a caching plugin?

Yes. Cloudflare caches static files by default; a page cache on the server still speeds up HTML.

Sources

• Cloudflare Docs: Add a site
• Cloudflare Docs: Change nameservers
• Cloudflare Docs: SSL/TLS encryption modes
• Cloudflare Docs: Default cache behavior