Basic Tutorial: Setting Up Cloudflare Free Tier

Profit Premium Domains

5 min read 896 words 2.2K views

Basic Tutorial: Setting Up Cloudflare Free Tier

Cloudflare acts as a reverse proxy for your website. Instead of users connecting directly to your web hosting server, they connect to Cloudflare’s global edge network. Cloudflare filters out bad traffic, caches content to make your site load faster, and passes clean traffic back to your origin server.

Create an Account & Add Domain: Sign up for a free account at cloudflare.com, click Add Site, and enter your domain name.
Select the Free Plan: Choose the Free tier when prompted during the setup wizard.
Review DNS Records: Cloudflare will automatically scan and import your existing DNS records (A, CNAME, MX). Ensure your main website domain (@ and www) have their proxy status set to Proxied (orange cloud icon active, rather than grey/DNS-only).
Update Nameservers: Cloudflare will give you two specific nameservers (e.g., ns1.cloudflare.com). Log into your domain registrar (where you bought the domain like Namecheap, GoDaddy, or Google Domains) and replace your current nameservers with Cloudflare’s.
Wait for Propagation: DNS propagation usually takes anywhere from a few minutes to a couple of hours. Once active, your traffic flows through Cloudflare.

Top 20 Things to Know (Focusing on Bots, Scrapers, and Hackers)

Core Setup & Security Foundation

The Orange Cloud Proxy: Only traffic routed through the Proxied (orange cloud) state benefits from Cloudflare’s Web Application Firewall (WAF), DDoS mitigation, and bot tools. Grey-clouded records expose your origin server’s direct IP address to attackers.
Always Use HTTPS: Navigate to SSL/TLS and set your encryption mode to Full (strict) if you have a valid SSL certificate on your web server. This ensures end-to-end encryption and prevents man-in-the-middle attacks.
Automatic HTTPS Rewrites: Turn this feature on under SSL/TLS settings. It automatically fixes mixed-content issues by changing http:// links to https:// on your pages.

Handling Bot Traffic & AI Scrapers

Bot Fight Mode: Found under Security > Settings, this free tool deploys lightweight JavaScript challenges and CPU-intensive computations to block simple scrapers and automated cloud hosting bots.
Block AI Training Bots: Directly toggle the option to block AI web crawlers and data harvesting models from scraping your site content for model training without affecting standard search engine discovery.
Understanding cf.client.bot: In Cloudflare custom firewall rules, you can use the built-in field cf.client.bot to identify whether Cloudflare recognizes a request as a verified good bot (like Googlebot) or an unverified automated script.
Static Resource Protection: Bot Fight Mode and security features shield static files (like images, archives, and media libraries) from being systematically downloaded in bulk by automated scraping routines.

Stopping Hackers & Web Attacks

WAF Custom Rules: Under Security > WAF > Custom Rules, you can write your own conditional rules using logic (e.g., blocking traffic based on country codes, specific User-Agents, or suspicious request paths).
Rate Limiting Rules: Protect login pages, search bars, or checkout forms by limiting how many requests a single IP address can make within a short timeframe (e.g., max 5 login attempts per minute).
The T1 Tor Network Code: Cloudflare classifies traffic originating from the Tor anonymity network under the T1 continent designation, allowing you to challenge or block hidden-node hackers easily.
Browser Integrity Check: This feature evaluates common HTTP headers from browsers. If a request lacks standard headers typical of a real browser (often a sign of a crude script or exploit tool), it throws an immediate challenge block.
Security Level Settings: Found under Security > Settings, setting this to Medium or High automatically prompts visitors with an interstitial challenge page if their IP address has a track record of malicious behavior elsewhere on the internet.

Performance & Caching (Keeping Sites Fast Under Attack)

Caching Static Assets: Cloudflare automatically caches images, CSS, and JavaScript files. When a bot or user requests static assets, Cloudflare serves them directly from its edge servers, preventing your origin server from crashing under high bot traffic loads.
Browser Cache TTL: Set an appropriate cache expiration time so repeat visitors and good bots don’t repeatedly demand resources directly from your backend server.
Under Attack Mode: If your site faces an active DDoS flood or a massive botnet surge, turning on Under Attack Mode forces every single visitor to pass a JavaScript verification check before entering your site.

Monitoring, Logs, and Troubleshooting

Security Events Tab: Navigate to Security > Events to inspect live logs of blocked traffic. It breaks down why a request was blocked (e.g., matching a custom rule, failing bot check, or rate-limiting trip) along with the visitor’s IP, country, and User-Agent.
IP Access Rules: If a specific hacker or aggressive scraper keeps slipping through, you can manually whitelist, challenge, or outright Block their specific IP address or entire country range under Security > WAF > Tools.
False Positives Happen: Aggressive bot and security settings can sometimes block legitimate users or essential API integrations. Always check your Security Events log first if a user reports layout bugs or login errors.
Turnstile (Free CAPTCHA Alternative): If you need to protect forms from automated spam bots without frustrating humans, use Cloudflare Turnstile. It provides invisible or non-interactive privacy-friendly challenges instead of annoying image-matching captchas.
Free Plan Limitations: Keep in mind that the Free tier provides basic analytics, standard DDoS protection, and Bot Fight Mode. Advanced machine-learning behavioral analytics, granular bot scoring, and automated API security require paid upgrades (Pro or Business tiers).