--- title: "Put your domain behind Cloudflare – free shield for your site · Wi24rd" description: "Move DNS to Cloudflare, switch on the orange cloud, and get DDoS protection and a free ruleset against known attacks in front of the site. Free, about 30 minutes – step by step." url: "https://wi24rd.com/en/security-tips/cloudflare-proxy/" lang: "en" alternates: da: "https://wi24rd.com/sikkerhedstips/cloudflare-proxy/" en: "https://wi24rd.com/en/security-tips/cloudflare-proxy/" --- Security tip 3 · Behind Cloudflare # Put your domain behind Cloudflare. When traffic goes through Cloudflare, DDoS protection and a free ruleset against known attacks stand in front of the site from the first minute. It costs nothing, and most of the time is spent waiting for DNS. Last checked 1 November 2026 [Go to the steps](https://wi24rd.com/en/security-tips/cloudflare-proxy/#trin)[See it working on wi24rd.com](https://wi24rd.com/en/right-now/) Time ~30 min + waiting for DNS Price Free Cloudflare’s free plan Protects Websites HTTP/HTTPS Needs Access to the domain at the registrar Why ## Without a shield, everything hits your server directly. When a website points straight at a server, the server’s address is public. Then it gets every single request – including the robots looking for password files, old WordPress installs and known holes. The server has to turn them all away itself, and every hole in the software stays open until someone updates. With Cloudflare’s proxy – the orange cloud – traffic first goes through Cloudflare’s network. Here DDoS protection and the _Cloudflare Free Managed Ruleset_ stop the most widespread attacks before they arrive. The ruleset is switched on automatically on the free plan, and Cloudflare adds new rules when a serious hole becomes known. _How it works: The visitor looks up the domain and ends up at Cloudflare. Cloudflare filters out known attacks and robots and passes the rest on to your server, whose address stays hidden._ 1. **Visitor**looks up the domain 2. **Cloudflare**close to the visitor 3. **Filter**known attacks out 4. **Your server**gets the rest **On wi24rd.com** The whole site sits behind Cloudflare on the free plan. On [Right now](https://wi24rd.com/en/right-now/) you can see the known vulnerabilities the ruleset has caught – including attacks on WordPress and React, which the site does not even run. [!\[Cloudflare managed ruleset with status Always active\](https://wi24rd.com/assets/img/skaerm/proxy-regelsaet.webp)](https://wi24rd.com/assets/img/skaerm/proxy-regelsaet.webp) _Security → Settings: the ruleset shows as Always active – on the free plan too. Screenshot from wi24rd.com’s Cloudflare account, November 2026._ Before you start ## Three things to have ready. - **A login at the registrar** – where the domain was bought. This is where the nameservers are changed. - **A list of your current DNS records** – especially mail (MX), SPF and DKIM. A screenshot is enough. Then you can check that nothing disappears in the move. - **DNSSEC switched off at the old provider**, if it is on. Otherwise the domain can stop working when the nameservers change. You switch it on again in Cloudflare afterwards. Step by step · Cloudflare ## Seven steps, about 30 minutes. 1. ### Create an account and add the domain Go to [dash.cloudflare.com](https://dash.cloudflare.com/sign-up), create an account and choose to add a domain. Pick the **Free** plan. 2. ### Compare the DNS records Cloudflare fetches the records it can find. Compare with your list and add anything missing – especially mail. Records for mail (e.g. `mail` and MX) must be **DNS only** (grey cloud), because the proxy only works for websites. 3. ### Change the nameservers Cloudflare shows two nameservers, e.g. `ada.ns.cloudflare.com`. Enter them at the registrar instead of the old ones. It can take from minutes to a day before Cloudflare marks the domain **Active**, and you get an email. [!\[Cloudflare’s two nameservers for wi24rd.com\](https://wi24rd.com/assets/img/skaerm/proxy-navneservere.webp)](https://wi24rd.com/assets/img/skaerm/proxy-navneservere.webp) _DNS → Settings shows the domain’s two nameservers. These are the ones to enter at the registrar. Screenshot from wi24rd.com’s Cloudflare account, November 2026._ 4. ### Switch on the orange cloud Under **DNS → Records**, set **Proxied** (orange cloud) on the records that point to the website – typically the domain itself and `www`. Only now does traffic go through the shield. [!\[The www DNS record with proxy status Proxied and an orange cloud\](https://wi24rd.com/assets/img/skaerm/proxy-dns.webp)](https://wi24rd.com/assets/img/skaerm/proxy-dns.webp) _The orange cloud and Proxied mean traffic goes through the shield. The CAA records from tip 2 are DNS only. Screenshot from wi24rd.com’s Cloudflare account, November 2026._ 5. ### Choose the right encryption Under **SSL/TLS → Overview**, press **Configure**. If your server has a valid certificate, choose **Full (Strict)** – or _Automatic SSL/TLS_, which Cloudflare itself recommends and which picks the safest mode your server can handle. Avoid _Flexible_, because then traffic travels unencrypted for the last leg to the server. Under _Edge Certificates_, also switch on **Always Use HTTPS** and set **Minimum TLS Version** to TLS 1.2, so old, weak connections are refused. [!\[The list of encryption modes with Full (Strict) highlighted\](https://wi24rd.com/assets/img/skaerm/proxy-ssl.webp)](https://wi24rd.com/assets/img/skaerm/proxy-ssl.webp) _Choose Full (Strict) or Automatic. wi24rd.com is on Full (Strict). Screenshot from wi24rd.com’s Cloudflare account, November 2026._ [!\[Always Use HTTPS switched on and Minimum TLS Version set to TLS 1.2\](https://wi24rd.com/assets/img/skaerm/proxy-https.webp)](https://wi24rd.com/assets/img/skaerm/proxy-https.webp) _SSL/TLS → Edge Certificates: Always Use HTTPS is on, and Minimum TLS Version is TLS 1.2. Screenshot from wi24rd.com’s Cloudflare account, November 2026._ 6. ### Switch DNSSEC back on Under **DNS → Settings**, switch DNSSEC on and copy the DS record to the registrar. Then nobody can pretend to be your domain in DNS. [!\[The DNSSEC card with the message Success! wi24rd.com is protected with DNSSEC\](https://wi24rd.com/assets/img/skaerm/proxy-dnssec.webp)](https://wi24rd.com/assets/img/skaerm/proxy-dnssec.webp) _Once the DS record is in place at the registrar, Cloudflare reports success. Screenshot from wi24rd.com’s Cloudflare account, November 2026._ 7. ### Check that it works Run the commands below. If the domain answers with Cloudflare addresses and `cf-ray` is in the response, traffic goes through the shield. Under **Security → Analytics** you can see what is caught. [!\[Chart of requests: mitigated by Cloudflare, served by Cloudflare and served by the origin\](https://wi24rd.com/assets/img/skaerm/proxy-analytics.webp)](https://wi24rd.com/assets/img/skaerm/proxy-analytics.webp) _Security → Analytics: the pink line is what Cloudflare caught in the last day. Screenshot from wi24rd.com’s Cloudflare account, November 2026._ ``` dig yourdomain.com +short curl -sI https://yourdomain.com | grep -i cf-ray ``` On Windows: `nslookup yourdomain.com`. The addresses should be in Cloudflare’s network – not your server’s own. Close the back door ## The shield only works if nobody can walk around it. If an attacker knows your server’s real address, they can still go straight to it. The old address can linger in historical DNS lookups for years. 1. ### Allow only Cloudflare Let the server’s firewall only accept web traffic from [Cloudflare’s IP addresses](https://www.cloudflare.com/ips/). Ask your web host if you do not manage the firewall yourself. 2. ### Consider a new address If the site has been directly online for years, ask for a new IP address once the proxy is on. 3. ### Keep watch from outside [Shodan Monitor](https://wi24rd.com/en/security-tips/shodan-monitor/) tells you if the server is visible after all. Honest about the limits ## What the shield does not do. - **It does not update your software.** The free ruleset covers the most widespread holes – not all of them. - **It only covers the website.** Mail, FTP, SSH and remote desktop go around the proxy. - **It does not stop stolen passwords.** A login is still a login – hence [tip 5](https://wi24rd.com/en/security-tips/cloudflare-access/) on locking the admin area. If you do not use Cloudflare, many web hosts and other CDN providers offer a web application firewall. Look for the words WAF and DDoS protection. **About this tip** wi24rd.com has sat behind Cloudflare since launch, and the figures for what the shield catches can be seen live on [Right now](https://wi24rd.com/en/right-now/) and in [The defences](https://wi24rd.com/en/machine-room/defences/). The steps were checked in Cloudflare’s dashboard on 1 November 2026. The man behind Wi24rd has used Cloudflare himself since he saw them at Black Hat in London in 2015. Wi24rd has no financial interest in Cloudflare – no money, discounts or services. [All security tips](https://wi24rd.com/en/security-tips/) [See the figures live](https://wi24rd.com/en/right-now/) [Back to Security tips](https://wi24rd.com/en/security-tips/)[To the top](https://wi24rd.com/en/security-tips/cloudflare-proxy/#top) ## Missing a tip? Write what you would like explained. The next security tip could be yours. [Write to Wi24rd](https://wi24rd.com/en/contact/)[The site’s own defences](https://wi24rd.com/en/security/)