What Cloudflare does for your website
Cloudflare sits between your visitors and your server. Every request passes through Cloudflare's global network first, where it can be filtered, cached and secured. Good visitors get a fast, cached website; attackers, bots and floods of fake traffic are stopped at the edge and never touch your server.
Threats Cloudflare protects against
| Threat | How Cloudflare helps |
|---|---|
| DDoS attacks | Absorbed by Cloudflare's network instead of your server |
| Brute-force logins | Rate limiting and challenges on login and admin URLs |
| Bad bots and scrapers | Bot rules and challenges, verified good bots (like Google) still allowed |
| SQL injection, XSS | Web Application Firewall rules |
| Spam forms and fake orders | Turnstile (a free, privacy-friendly CAPTCHA alternative) and rules |
| Snooping on data | Free SSL/TLS encryption between visitor, Cloudflare and your server |
The mistakes most setups make
- SSL set to “Flexible”: the connection between Cloudflare and your server is unencrypted, and it often causes redirect loops. Use Full (strict).
- The origin IP is still public through old DNS records, mail records or the server itself, so attackers skip Cloudflare entirely.
- Grey-clouded (DNS-only) records for the main website, so traffic isn't protected at all.
- No rules for login and admin pages, which are the most attacked URLs.
- Caching that breaks carts, logins or admin panels because dynamic pages are cached.
Is the free plan enough?
For most small and medium businesses in Bangladesh, yes: Cloudflare's free plan includes DNS, SSL, DDoS protection, basic WAF rules, caching and Turnstile. Paid plans add more advanced firewall rules, image optimisation and support. I'll recommend the plan that fits your risk and budget.
Works with everything
WordPress, WooCommerce, Shopify custom domains, Laravel, Next.js and any site on shared hosting, VPS or cloud. Combine it with Bunny CDN for images and files and a hardened VPS for complete protection.