Cloudflare for Your Website: 10 Security and Speed Best Practices

Cloudflare works as a front door between your visitors and your site: it filters attacks, stores copies of your files close to each visitor and manages your DNS. Plenty of people switch it on, see that the site still works and stop there. The real value is in the configuration. These are the ten practices we apply on real projects.

1. Proxy your DNS records

In the DNS panel, your site's records (A, AAAA and CNAME) should show the orange cloud. That way visitors talk to Cloudflare instead of your server, and your server's real address stays hidden. Email records (MX, and the SPF or DKIM TXT records) are not proxied, and that's normal.

2. Use SSL/TLS in Full (strict) mode

“Flexible” mode only encrypts the leg between the visitor and Cloudflare; the leg to your server travels unencrypted. Use “Full (strict)” with a valid certificate on your server (a free Cloudflare Origin Certificate works). Also turn on “Always Use HTTPS” and “Automatic HTTPS Rewrites”, and set the minimum TLS version to 1.2.

3. Enable HSTS, but only after testing

HSTS tells the browser never to open your site without HTTPS. It's excellent, but hard to undo if you enable it while some subdomains still have no certificate. Start with a short duration, check that everything loads, then raise it.

4. Protect your DNS with DNSSEC

DNSSEC signs your records so nobody can forge them along the way. In Cloudflare it's a one-click switch, completed by adding a DS record at your domain registrar.

5. Turn on the WAF and add your own rules

The managed rules of the web application firewall (WAF) block known attacks such as SQL injection or XSS. Complement them with custom rules: limit the number of attempts on your contact form and login (rate limiting), and require a challenge from anyone requesting admin paths your site doesn't use.

6. Replace CAPTCHA with Turnstile

Turnstile is Cloudflare's challenge for forms: free, and almost always invisible to real people. Remember that the token must be validated on your server; if you only display it on screen, a bot can skip right past it.

7. Configure caching on purpose

• Static files (images, CSS, JavaScript with unique filenames): long cache, months or a year.
• Public HTML pages: short cache or with revalidation; never cache pages containing a user's session data.
• Use Cache Rules to define exceptions, for example not caching /admin or /api.
• Check the cf-cache-status header: HIT means Cloudflare answered from its cache.

8. Add security headers

With Transform Rules (or from your own site), add these response headers:

• Strict-Transport-Security: forces the use of HTTPS.
• X-Content-Type-Options: nosniff, stops the browser from guessing file types.
• Referrer-Policy: strict-origin-when-cross-origin, limits what you share when linking out.
• Permissions-Policy: switches off camera, microphone and location if you don't use them.
• Content-Security-Policy: defines where scripts may be loaded from. It's the most powerful and the most delicate; start in “Report-Only” mode.

9. Protect your email from the DNS

A domain without SPF, DKIM and DMARC can be spoofed to send fake emails in your business's name, and your legitimate messages end up in spam more often. Publish all three TXT records and start DMARC at “p=none” to observe, then move to “quarantine” and “reject”.

10. Secure access to the account itself

• Turn on two-step verification on your Cloudflare account.
• Use API tokens with minimal permissions instead of the Global API Key.
• Protect staging environments and internal dashboards with Cloudflare Access.
• Turn on security event notifications and actually review them.

How to tell it's set up right

Test your domain on SSL Labs (encryption), securityheaders.com (headers) and PageSpeed Insights (speed). If anything comes back red, you know which practice on this list is missing. On every Diskette Studio project we leave this configuration documented and in your name.