A proper Cloudflare Pro setup covers six areas: DNS records, SSL/TLS mode, firewall and WAF rules, bot protection, caching, and protecting the origin server. Buying the plan only switches the features on. If DNS records are copied wrongly, email can stop; if the SSL mode is wrong, the site can loop or show errors; and if caching is too aggressive, customers can see each other’s carts. Getting these settings right is what turns Cloudflare Pro into real protection.
This guide walks through what to configure, in order, and why each step matters.
1. Review the site before changing anything
Cloudflare becomes part of the path between your domain, website, email and any other services. Before onboarding, list:
- Where the website is hosted, and its server IP address.
- Every existing DNS record: A, AAAA, CNAME, MX, TXT (SPF, DKIM, DMARC, verification records) and SRV.
- Where email is hosted.
- Subdomains in use, such as shop, portal, mail or api.
- The platform: WordPress, WooCommerce, a custom app, APIs or payment callbacks.
Export or screenshot the current DNS zone. It is your rollback plan.
2. Get DNS right
In a standard setup you change your domain’s nameservers at the registrar to the two Cloudflare nameservers assigned to you. Cloudflare then answers all DNS queries for the domain. Before you switch:
- Check the imported records against your list. Cloudflare scans for records automatically but can miss some, especially TXT records and less common subdomains.
- Choose proxied or DNS only for each record. Proxied (orange cloud) routes traffic through Cloudflare and gives you protection and caching. DNS only (grey cloud) simply points to the IP. Use proxied for the website and www.
- Keep mail records DNS only. MX records cannot be proxied, and the hostname that mail points to (for example mail.yourdomain) must stay DNS only. Proxying it breaks email.
- Keep SPF, DKIM and DMARC TXT records exactly as they were, or emails may start landing in spam.
- Turn on DNSSEC once the zone is active, by adding the DS record Cloudflare gives you at your registrar. This protects against forged DNS answers.
Nameserver changes can take some hours to spread. Keep the old DNS zone in place until Cloudflare shows the domain as active.
3. Configure SSL/TLS correctly
Cloudflare encrypts the connection between visitors and Cloudflare. The SSL/TLS mode controls the connection from Cloudflare to your server:
- Flexible sends traffic to your server unencrypted. Avoid it. It also causes redirect loops when the server itself forces HTTPS.
- Full encrypts the connection but does not check the server’s certificate.
- Full (strict) encrypts and checks for a valid certificate. Use this.
For Full (strict), the server needs a valid certificate: a free certificate from your host, a paid certificate, or a Cloudflare Origin CA certificate. Then turn on Always Use HTTPS, set the minimum TLS version to 1.2, and consider HSTS only once you are sure every subdomain works on HTTPS, because HSTS is hard to undo quickly.
4. Set up the web application firewall
Pro gives access to Cloudflare’s managed WAF rulesets. Configure them deliberately:
- Enable the Cloudflare Managed Ruleset to block known attack patterns and exploits for common software.
- Enable the OWASP Core Ruleset with a sensible sensitivity, and watch for false positives on forms and admin pages.
- Add custom rules for your site, for example restricting wp-admin or other admin areas to your team, or challenging traffic to login pages.
- Add rate limiting on login, contact and checkout endpoints to slow down password guessing and form spam.
- Allow legitimate services such as payment gateway callbacks, uptime monitors and APIs, so they are not blocked.
5. Control bots
Pro includes Super Bot Fight Mode. Set definitely automated traffic to be blocked or challenged, and allow verified bots such as search engine crawlers. Test that your own integrations still work afterwards.
6. Tune caching without breaking dynamic pages
By default Cloudflare caches static files such as images, CSS and JavaScript, not HTML pages. Faster setups also cache pages, but carefully:
- Bypass the cache for admin areas, logins, carts, checkouts, account pages and anything personalised.
- For WordPress, consider Automatic Platform Optimization (APO), which caches pages at the edge and respects logged-in users. Otherwise use cache rules that skip logged-in and cart cookies.
- Turn on image optimisation to send smaller images to phones and slow connections.
- Purge the cache after major site changes.
7. Protect the origin server
Cloudflare only protects traffic that passes through it. If attackers know your server’s IP, they can go around it.
- Allow web traffic to the server only from Cloudflare’s published IP ranges where your hosting allows it.
- Consider Authenticated Origin Pulls, so the server accepts only requests that really come from Cloudflare.
- Restore real visitor IPs in server logs and security tools, using the header Cloudflare sends, so blocking and analytics still work.
- If the IP was public for a long time before Cloudflare, ask your host whether it can be changed.
8. Test, then monitor
- Test the home page, forms, logins, checkout and payments.
- Send and receive email to and from external addresses.
- Check the Security Events log for real visitors being challenged or blocked, and adjust rules.
- Review analytics and security events regularly, not only at setup.
Let Tremhost set it up for you
Tremhost is a Cloudflare partner. Armor Guard is Cloudflare Pro for one site, with DNS moved across, firewall rules, SSL and monitoring handled by Tremhost’s team, for $9 a month or $90 a year. Bought direct from Cloudflare, Pro is $25 a month and you configure it yourself. For larger sites, Armor Shield is Cloudflare Business, managed, at $200 a month. You can try Pro or Business free for 15 days, no card needed. Cloudflare Pro is also included on every managed WordPress site.
Frequently asked questions
Will moving to Cloudflare take my site offline?
Not if DNS records are copied correctly before the nameservers change. Visitors switch over gradually as DNS updates.
Why did my email stop working after adding Cloudflare?
Usually because a mail hostname was proxied or an MX or TXT record was missed. Set mail records to DNS only and check SPF, DKIM and DMARC.
Which SSL mode should I use?
Full (strict), with a valid certificate on your server.
Does Cloudflare Pro remove malware?
No. It blocks attacks from outside but does not clean an infected site. Clean the site first, then put protection in front of it.
Next step
See what Armor Guard includes, or start the free 15-day trial, on the Tremhost Armor page.
