What is Cloudflare?
Cloudflare is a network that sits between your visitors and your web host. When your domain points at Cloudflare, requests arrive at the nearest Cloudflare data centre first. It answers what it can from its cache, filters out obvious attacks and junk traffic, and passes the rest to your real server.
It is also a DNS provider, so it can manage the records that say where your website and email live. What it is not, for a normal WordPress or WooCommerce site, is the place your site actually runs. You still need a host.
So when someone tells you to "just put Cloudflare on it", the honest answer is: it can make a decent site faster and safer for visitors across Thailand, but it will not rescue a slow server, a heavy theme or a bloated plugin stack. And a few default settings, if chosen carelessly, cause redirect loops, stale shopping carts and broken email.
This guide is part of our SEO, speed and analytics articles. We build websites and do not sell hosting or Cloudflare plans, so nothing here is a sales pitch for a provider.
Is Cloudflare hosting?
Mostly, no. Cloudflare's core product is a reverse proxy: a middleman that receives traffic for your domain and forwards it to an origin server you rent elsewhere. Your WordPress files, database, PHP and uploads stay on that origin. If the origin goes down, Cloudflare can sometimes show a cached copy of static pages, but forms, bookings and checkouts stop working.
The confusion comes from Cloudflare Pages and Workers. Pages hosts static sites and front ends built with frameworks, and Workers runs small pieces of code at the edge. Both are real hosting, but for a different kind of site. A standard WordPress install needs PHP and a MySQL or MariaDB database, which Pages does not provide. If you run WordPress, WooCommerce or most off-the-shelf CMS platforms, Cloudflare is a layer in front, and the table below shows who does what.
| Job | Your web host | Cloudflare in front |
|---|---|---|
| Stores WordPress files and database | Yes | No |
| Runs PHP, plugins, forms and checkout | Yes | No |
| Manages DNS records | Sometimes | Yes, once nameservers point to it |
| Caches images, CSS and scripts near visitors | Only if the host has its own CDN | Yes |
| Filters attacks and bad bots | Basic, depends on host | Yes, at the edge |
| Issues the visitor-facing SSL certificate | Yes, without Cloudflare | Yes, when proxied |
| Backups and restores | Yes, if included | No |
What the CDN does for visitors in Thailand
A CDN keeps copies of files close to the people requesting them. If your host is in Singapore, Europe or the US, a visitor in Chiang Mai or Hat Yai normally waits for every image and stylesheet to travel that distance. With Cloudflare proxying the site, those static files can be served from a nearby Cloudflare location instead.
Cloudflare's public network map lists locations in Thailand at the time of writing; check the current map rather than assuming, because which data centre serves a visitor also depends on their mobile or broadband provider. Distance mainly costs speed; our guide on whether server location affects SEO covers the ranking side.
What is cached by default, and what is not
- Cached: images, CSS, JavaScript, fonts and other static files, based on file extension.
- Not cached by default: the HTML pages themselves. Every page view still goes back to your server to build the page, unless you add a cache rule or a product such as APO.
- Never to be cached: anything personal, such as a cart, checkout, account page or a logged-in dashboard.
That second point is why many owners see smaller gains than they expected. If your server takes two seconds to generate the HTML, the CDN does not change that. Heavy images are the other common drag, and a CDN only moves them faster; it does not shrink them. Our guide to compressing and sizing website images covers that side, and the usual reasons a WordPress site feels slow covers server, theme and plugin causes a CDN cannot touch.
SSL modes: the setting people get wrong
When Cloudflare proxies your site there are two encrypted connections: visitor to Cloudflare, and Cloudflare to your server. The SSL/TLS mode decides how the second one works.
- Off: no encryption. Do not use it.
- Flexible: the visitor sees a padlock, but Cloudflare talks to your server over plain HTTP. Data between Cloudflare and your host travels unencrypted.
- Full: encrypted to your server, but the server's certificate is not checked.
- Full (strict): encrypted, and the server must present a valid certificate, either a public one or a free Cloudflare Origin CA certificate.
Choose Full (strict). Flexible looks tempting because it works on a server with no certificate, but it has two problems. It leaves part of the journey unencrypted, which is a poor fit for any site that collects names, phone numbers or payment details under PDPA. And it causes the classic redirect loop: WordPress or the host is set to force HTTPS, receives an HTTP request from Cloudflare, redirects to HTTPS, Cloudflare requests HTTP again, and the browser gives up with "too many redirects". If you have ever seen that error right after switching Cloudflare on, the SSL mode is the first place to look.
Security: firewall, bots and DDoS
Because every request passes through Cloudflare first, it can block traffic before your server spends any effort on it. For a small business site this matters most with login attacks on wp-login.php, comment and form spam, and floods of automated requests that make a cheap host fall over.
At the time of writing, Cloudflare's plans page lists DDoS protection and a basic set of firewall and bot tools on the Free plan, with more detailed rules, a larger managed firewall ruleset and better bot controls on paid tiers. Plan contents change, so read the current Cloudflare plans page before deciding.
Rules worth adding on almost any WordPress site
- A challenge on the login page for visitors outside the countries your staff log in from.
- Rate limiting or a challenge on XML-RPC, or block it if nothing uses it.
- Bot protection switched on, then tested: some settings interfere with payment gateway callbacks or uptime monitors, so allow those explicitly.
None of this replaces updates and backups on the server. A firewall reduces the noise; an out-of-date plugin can still be exploited through a request that looks normal.
WordPress and WooCommerce caching rules
If you decide to cache HTML at the edge, which is where the real speed gain for WordPress sits, you must tell Cloudflare what never to cache. Get this wrong on a shop and one customer can see another customer's cart, or a price change takes hours to appear.
Bypass the cache for
- Cart, checkout and my-account pages, and any URL with WooCommerce query strings such as add-to-cart.
- Requests carrying WordPress login or WooCommerce session cookies.
- wp-admin, wp-login.php and the REST API endpoints your forms use.
- Payment return and webhook URLs from your gateway, including PromptPay and card providers.
What APO does
Automatic Platform Optimization is Cloudflare's ready-made option for WordPress. A plugin on your site tells Cloudflare when content changes, and Cloudflare caches the HTML across its network, skipping the cache for logged-in users and common WooCommerce cookies. At the time of writing it is a paid add-on on the Free plan and included on higher plans; check the current APO documentation for the exact terms. For a brochure site or blog it is often the simplest way to get cached HTML. For a busy shop, test cart, coupon and stock behaviour carefully before relying on it.
Also purge the cache after design changes. When a change does not appear on the live site, an old stylesheet held at the edge is a common cause.
Setting it up
The switch itself takes minutes. The care goes into DNS, because moving nameservers means Cloudflare becomes the source of truth for every record on your domain, including email. Before you start, take a screenshot or export of the current DNS zone at your registrar or host. If you use Google Workspace or Microsoft 365 for company email, note the MX, SPF, DKIM and DMARC records in particular.
The one rule that saves the most trouble: only web traffic should be proxied (the orange cloud). Mail records, and any hostname your mail server uses, must be DNS only (the grey cloud). Cloudflare's standard proxy handles web traffic, not mail, so proxying a mail hostname can stop email arriving. It also helps to lower the TTL on key records a day before the move, so any mistake corrects itself quickly.
- Step 1
Export current DNS
Copy every record from the registrar or host, including MX, SPF, DKIM and DMARC.
- Step 2
Add the site to Cloudflare
Cloudflare scans existing records. Compare its list with your export and add anything missing.
- Step 3
Set proxy status per record
Orange cloud for the website and www. Grey cloud for mail, FTP and anything that is not web traffic.
- Step 4
Install an origin certificate
Put a valid certificate on the server, then set SSL/TLS to Full (strict).
- Step 5
Change nameservers
Update them at your domain registrar. For .co.th domains this is done through your registrar's panel.
- Step 6
Test before you relax
Send and receive email, submit every form, place a test order and check the payment return page.
- Step 7
Add cache and security rules
Bypass rules for cart, checkout and login, then any firewall rules you need.
When Cloudflare is not worth it
Cloudflare is free to try and easy to remove, but it is not always the best use of an afternoon.
- Your host already includes a CDN and firewall. Many managed WordPress hosts do. Two layers of caching can make problems harder to trace.
- The slowness is on the server. If the time to first byte is poor, fix the hosting, theme or plugins first. Learning what a speed test report is actually telling you helps you see which number is the problem before and after any change.
- Nobody will look after it. Cache rules and firewall settings need someone who remembers they exist when a form or payment callback stops working.
- Your audience is almost entirely near the server. A site hosted in Bangkok for Bangkok customers gains less from edge caching of static files, though the security features still help.
Keep expectations honest on search, too. A faster, more stable site supports rankings and conversions, but Cloudflare is one small part of that picture. Our article on how design choices influence search rankings covers the bigger levers, and tracking the few website numbers a small business should watch tells you whether a change helped.
If you would rather have the whole speed picture handled, from hosting settings to images and Cloudflare rules, our Core Web Vitals and speed optimization service covers it, priced on request. For a new build, see our website package prices, or send us a message on WhatsApp at +66 93 004 4098.
Who reviewed this guide
Who builds your site
Litesh Dhir
Builds and ranks the websites: the systems behind the 17 client sites whose Search Console numbers we publish.
More about usMore on speed and performance
Sources
- Cloudflare network map
- Cloudflare plans
- Cloudflare SSL/TLS encryption modes
- Cloudflare Automatic Platform Optimization for WordPress
- Cloudflare Pages documentation