Websites protected by Cloudflare, in plain English
Every site I build runs behind Cloudflare, including this one. Most of the protection is free and on from day one, so below I say what each layer does and which parts are paid.
What protects your site
Eleven layers sit between a stranger on the internet and your website. Each one is tagged free if it is included on every site I build, or paid if it is a paid Cloudflare feature I only add when a site needs it, and tell you the cost first. No package includes a paid Cloudflare plan.
DDoS protection
freeFloods of junk traffic aimed at knocking a site offline are soaked up at Cloudflare's edge, before they reach your site. It is unmetered, so a bad day does not turn into a bill.
WAF managed rules
freepaidA web application firewall checks each request for known attack patterns and stops the ones that match. The basic managed set is free. The full OWASP rule set is on Cloudflare's paid Pro plan, and I switch it on only for sites that need it.
Bot Fight Mode
freeChallenges traffic that looks like a known bad bot, such as scrapers and scripts that guess passwords, while real visitors and search engines go straight through.
Turnstile spam-proof forms
freeCloudflare's replacement for CAPTCHA puzzles. It checks in the background that a visitor is a real browser, so most people never see a challenge. It guards the free demo form on this site.
SSL/TLS certificates
freeYour site is served over HTTPS with a certificate that is issued and renewed automatically, so there is no renewal date to forget and no browser warning to explain.
Global CDN with a Dublin data centre
freeCopies of your pages are kept in Cloudflare's data centres around the world, including one in Dublin, so a visitor in Ireland is served from close by rather than from a single faraway server.
Rate limiting on forms
freeA limit on how often one visitor can submit a form in a short window, so a script cannot flood your inbox. A basic rule is free; larger sets of rules are a paid Cloudflare feature.
Email address obfuscation
freeEmail addresses written on a page are scrambled in the page source so harvesting bots cannot read them, while people still see and click them normally.
DNSSEC
freeSigns your domain's DNS records so nobody can quietly send visitors to a fake copy of your site. It needs one record added at your domain registrar to be fully on.
Cached pages stay up if the origin wobbles
freeIf the server behind a site is slow or down, Cloudflare can keep serving saved copies of your pages. It covers pages that were cached, not forms or checkouts.
Cloudflare Access for admin areas
freePuts a login in front of an admin area, such as a staff dashboard or a site editor, before the page itself loads, so only people you have approved get that far. It is free for up to 50 users.
What goes wrong without it
A website with nothing in front of it is not usually targeted by anyone in particular. It is found by software that tries every site it can reach, so the same four problems keep turning up.
Contact forms flooded with spam
A form with nothing in front of it gets found by bots. Real enquiries end up buried, and sooner or later you stop reading the inbox.
Brute-forced WordPress logins
Bots try password after password against the standard WordPress login address, around the clock. One weak password is all it takes for someone to be inside your site.
Cheap DDoS-for-hire
Flooding a website with traffic can be rented for very little. A small site with no protection goes offline until the flood stops, and it may be a rival or a prank that paid for it.
Expired SSL warnings
A certificate somebody forgot to renew puts a full-page security warning in front of every visitor, and they turn back, quite reasonably.
What Cloudflare does not do
Cloudflare protects the traffic going in and out of a site. It does not fix a weak password, an out-of-date plugin or a missing backup, so it is one layer, not the whole answer.
That is why the care plans also cover updates, backups and monitoring, and why the sites I build have no plugin pile to keep patched in the first place. Cloudflare, plain code and regular care work together.
Questions people ask
Is Cloudflare protection included in the price?
The free layers on this page are on every site I build and are not billed separately. No package includes a paid Cloudflare plan. If a site ever needs a paid feature, I tell you the cost first and it is billed at cost.
Does Cloudflare make my site faster?
It can, because saved copies of your pages are served from a data centre near the visitor, including one in Dublin. Speed also depends on how the site is built, which is why I build pages light as well.
Can a site behind Cloudflare still be hacked?
Yes. Cloudflare filters traffic in front of a site. It does not fix what is wrong inside it, such as a weak password or an out-of-date plugin. That is why updates and backups are part of the care plans.
Do I need my own Cloudflare account?
The Cloudflare account is set up in your name, and I am added as a member so I can look after it for you. If we ever part ways, you remove my access and nothing else changes.
What is Turnstile, and does it track my visitors?
Turnstile is Cloudflare's spam check for forms. It confirms in the background that a visitor is a real browser, so most people never see a puzzle. This site uses it on the free demo form, and the privacy policy says what it does with the check.
See your new website before you pay a cent.
Tell me about your business and I'll build a free demo of your new site: a real, working preview, no payment details and no obligation. Love it, and I launch it.