CloudFlare is one of the world’s leading platforms for website optimization and protection. It’s a service that works as an intermediate layer between Your website and visitors, providing enhanced performance, security, and reliability. The platform offers a wide range of solutions, from accelerating page loading through a global content delivery network (CDN) to powerful protection against cyber attacks.

One of CloudFlare’s key features is DDoS attack protection, which automatically blocks malicious traffic, allowing Your site to remain accessible even under high-threat conditions. CloudFlare also provides HTTPS connection encryption capabilities, access control through web application firewalls (WAF), and intelligent traffic management. These features make CloudFlare an indispensable tool for site owners seeking stable and secure operation of their resources.

Step-by-Step Connection Guide

1. Registration and Obtaining CloudFlare NS Servers

Go to Cloudflare and create an account. After logging into Your account, click + Add ➔ Existing domain and enter Your domain. Select Quick scan for DNS records and wait for the existing DNS records to be scanned.

If no records are found, then create at least two basic A type records, for the main domain @ and for the alias www, direct these records to Your hosting IP address.

Select a pricing plan (You can start with the Free plan).

2. Changing NS Servers at Your Registrar

CloudFlare will provide You with two NS servers that need to be configured at Your current registrar.

3. Setting up DNS for Mail in CloudFlare Panel

Go to DNS ➔ Records, click + Add record. Then add A, TXT, and MX records for proper mail functionality.

If DKIM or DMARC or any other records are used and auto-search didn’t find them, You’ll need to add these records manually as well. An example of mail record settings is demonstrated in our guide. To save the added record, click Save.

SSL Certificate Setup

When connecting a domain to Cloudflare, two separate connections are created: from user to CloudFlare and from CloudFlare to Your hosting.

The first connection is automatically protected by a free SSL Universal certificate from CloudFlare. For complete protection, You need to configure encryption for the second connection as well.

Encryption Modes

Detailed comparison of encryption modes.

1. Off:

• Complete lack of encryption.
• Not recommended for use.
• Site is only accessible via HTTP.

2. Flexible:

• Encryption only between user and CloudFlare.
• Data between CloudFlare and hosting is transmitted unprotected.
• Suitable as a temporary solution.
• Users see HTTPS in browser.

3. Full:

• Encryption on both connection segments.
• Requires SSL certificate on hosting.
• Medium security level.
• Accepts even self-signed certificates.

4. Full (Strict):

• Maximum security level.
• Requires valid SSL certificate on hosting.
• Verifies certificate authenticity.
• Recommended mode when having a commercial SSL.

Additional Security Settings

If You notice accessibility issues or clients complain that sites don’t open for everyone, You can use additional settings such as forced HTTPS traffic redirect, minimum TLS version support, or improved compatibility with older browsers.

1. Always Use HTTPS:
   • Go to SSL/TLS ➔ Edge Certificates.
   • Enable the Always Use HTTPS option.
   • Provides automatic redirection from HTTP to HTTPS.

2. Minimum TLS Version:

   • Recommended to set TLS 1.2 or higher.
   • Provides modern security standards.
   • Reduces the risk of using vulnerable protocols.

3. Opportunistic Encryption:

   • Improves compatibility with older browsers.
   • Provides an additional layer of protection.
   • Recommended to keep enabled.

How to Protect Your Site from DDoS Attacks

Connecting Your site to CloudFlare already provides basic protection against DDoS attacks. The platform hides Your server’s IP address and redirects all traffic through its secure servers. This allows blocking malicious traffic before it reaches Your hosting.

Content caching also significantly reduces the load on Your hosting during attacks. However, for maximum protection, it’s recommended to configure additional security parameters in Your Cloudflare account.

“I’m Under Attack!” Mode

The I’m Under Attack! mode is one of the most powerful tools for DDoS attack protection in CloudFlare. When activated, the system applies multi-level verification to each visitor.

You can enable it in the Security ➔ Settings ➔ Security Level section.

1. Initial Check:

   • Visitor first sees an intermediate page with the message DDoS protection by CloudFlare.
   • System performs automatic analysis of visitor’s browser.
   • Check lasts 5-10 seconds.

2. Verification Process:

   • Browser behavior is analyzed.
   • JavaScript functionality is checked.
   • Request speed and patterns are evaluated.
   • Bot presence is checked.

3. Check Results:

   • Upon successful verification, visitor gets access to the site.
   • When suspicious activity is detected, request is blocked.
   • Legitimate users receive temporary access (30 minutes by default).

When to Use “I’m Under Attack!”

Recommended Usage Scenarios:

1. During active DDoS attacks.
2. When sudden increase in suspicious traffic occurs.
3. When standard protection measures aren’t helping.
4. During massive password brute-force attempts.

Alternative Protection Levels:

If full I’m Under Attack! mode is too aggressive, consider other security levels.

1. High:

   • Checks only suspicious traffic.
   • Shows verification to visitors from suspicious IPs.
   • Less impact on legitimate users.

2. Medium:

   • Balanced protection.
   • Checks only very suspicious requests.
   • Suitable for daily use.

3. Low:

   • Minimal checks.
   • Blocks only confirmed threats.
   • For sites with low attack risk.

Firewall Rules Setup

Properly configured firewall rules are an important component of site protection against attacks and unwanted traffic. With CloudFlare tools, You can create flexible rules for blocking malicious requests, limiting access to certain resources, or allowing access only to trusted users.

The firewall works as a filter between Your site and visitors, analyzing each request. This allows detecting and blocking suspicious actions such as automated data collection attempts, password guessing, or excessive server load. Access rule configuration not only helps fight DDoS attacks but also provides additional flexibility for traffic management.

To create access rules:

1. Go to Security ➔ WAF ➔ Custom rules.
2. Click Create rule.
3. Configure parameters:
   • Rule name: rule name.
   • Field: filtering parameter (IP address, Country, User Agent).
   • Operator: trigger condition.
   • Value: filtering value.

How to Clear Cache

When using CloudFlare, caching will occur by default, so after each site update, You’ll need to manually clear the cache. If You don’t do this, users will see the changed content for some time.

To clear cache, go to the Caching ➔ Configuration tab. The Custom Purge button will clear cache for any individual URL, while the Purge Everything button will remove all cache from Cloudflare servers, however, complete clearing will temporarily increase the number of requests to the server and the site may slow down. We recommend choosing the first option.

To avoid inconvenience for users due to outdated content, we recommend regularly clearing cache when making changes to the site.

If You frequently update information, consider setting up automatic cache clearing or reducing cached data lifetime in CloudFlare settings. This will help maintain balance between site loading speed and content relevance for visitors.