Cloudflare can place a global reverse proxy between visitors and an origin server. This allows DNS, caching, DDoS protection, TLS, and web application controls to work along the same request path. The important detail is that Cloudflare DNS and Cloudflare proxying are related, but they are not the same thing.
A domain can use Cloudflare as its authoritative DNS provider while a record remains DNS-only. In that state, DNS resolves the hostname, but web requests go directly to the origin. Cloudflare’s WAF and proxy-based protection do not inspect that traffic.
What DNS, proxying, and the WAF each do
| Layer | Primary job | Important limitation |
|---|---|---|
| Authoritative DNS | Answers queries that map hostnames to their destinations. | DNS service alone does not inspect HTTP requests. |
| Cloudflare proxy | Receives HTTP and HTTPS traffic before forwarding allowed requests to the origin. | Only proxied records use proxy-based security and performance features. |
| WAF rules | Evaluate web requests for known exploit patterns and custom conditions. | Rules can produce false positives and require monitoring and exceptions. |
| Origin controls | Protect the server, application, data, and management services. | They remain necessary even when Cloudflare is in front. |
Cloudflare recommends proxying A, AAAA, and CNAME records that serve web traffic when you want DDoS protection, caching, WAF, and related features. Mail records and non-web services usually have different requirements and should not be changed blindly.
Practical reasons to use the proxied service
The proxy can absorb and filter a large amount of unwanted internet traffic before it reaches the server. Caching can reduce repeated work at the origin and improve delivery for visitors in different regions. Central TLS and redirect controls can simplify parts of the public web configuration.
For a self-hosted WordPress site, reducing direct traffic to the origin can improve resilience. It does not make the origin disposable. WordPress, PHP, the database, Coolify, SSH, and any other exposed service still need patching, access control, backups, and monitoring.
Cloudflare can reduce what reaches the origin. It cannot repair vulnerable application logic that an allowed request can still reach.
J77Cyber layered defence principle
Using the WAF without blocking normal users
Managed rules are preconfigured controls for common web attack techniques. The rules available depend on the plan. Cloudflare documents a Free Managed Ruleset for high-impact, widely exploited vulnerabilities, while broader Cloudflare and OWASP rulesets are available on paid plans.
Start with the defaults that match the plan and technology stack. Review Security Events before creating exceptions. If a legitimate WordPress request is blocked, identify the exact rule, request path, and intended behaviour. Create the narrowest practical exception rather than disabling the whole ruleset.
- Confirm the web record is proxied, not DNS-only.
- Deploy the managed ruleset available on the account.
- Review events after WordPress login, editing, uploads, forms, and API traffic.
- Scope exceptions to the smallest safe path, method, or verified condition.
- Keep rate limits and authentication controls appropriate to sensitive routes.
Protect the origin as a separate layer
If attackers can discover the origin address and connect to it directly, they may bypass proxy-based controls. Where the architecture allows it, restrict public web access at the server or provider firewall to Cloudflare’s published IP ranges. Plan an update process because those ranges can change.
Keep SSH separate from the web proxy design. Use key-based authentication, disable direct root login, limit administrative access, and monitor authentication logs. Cloudflare also needs accurate origin TLS settings. Avoid insecure modes that encrypt only part of the request path.
The strongest design is layered: reliable DNS, proxied web records, appropriately tuned WAF controls, a locked-down origin, maintained software, secure authentication, and tested backups.