Adding Cloudflare in front of your Cloudways WordPress site cuts perceived page load time by 200-400ms for global visitors, blocks 99% of malicious bot traffic, and gives you free DDoS protection. Cloudways also offers a paid Cloudflare Enterprise integration ($5/mo) that unlocks features normally reserved for $200/mo Cloudflare Enterprise customers. This is the complete 2026 setup guide covering both options.
Which Cloudflare option to pick in 2026
Free Cloudflare (self-integrated) covers 80% of what most WordPress sites need: CDN, SSL, basic DDoS. Setup takes 15 minutes. Cloudflare Enterprise via Cloudways ($5/mo) adds priority routing (Argo Smart Routing), Image Optimization, HTTP/3 by default, and 300+ edge cities. Worth it for revenue-generating sites and PH audience (better routing to Southeast Asia).
Option 1: Free Cloudflare with Cloudways (15-minute setup)
Step 1: Sign up for Cloudflare and add your domain
Go to cloudflare.com and create a free account. Click Add Site, enter your domain (e.g., yourdomain.com), and select the Free plan. Cloudflare will scan your existing DNS records and import them.
Step 2: Update nameservers at your domain registrar
Cloudflare gives you two nameservers (like anna.ns.cloudflare.com and bob.ns.cloudflare.com). Go to your domain registrar (GoDaddy, Namecheap, Namesilo, wherever you bought the domain) and change the nameservers to the two Cloudflare provided. Propagation takes 2-24 hours globally.
Step 3: Verify DNS records point to Cloudways IP
In Cloudflare’s DNS panel, ensure the A record for @ (root domain) and www point to your Cloudways application IP address. The orange cloud icon should be ON (meaning traffic proxies through Cloudflare). If the cloud is grey, Cloudflare only handles DNS and does not proxy your traffic.
Step 4: Configure SSL mode in Cloudflare
Go to SSL/TLS in Cloudflare’s sidebar. Set the mode to Full (strict). This encrypts traffic between the visitor and Cloudflare, and between Cloudflare and your Cloudways origin server (Cloudways has a Let’s Encrypt cert installed by default). Avoid the “Flexible” mode which is less secure.
Step 5: Enable Cloudflare caching rules for WordPress
Under Rules > Page Rules (or Rules > Cache Rules in the new UI), add these three rules:
- Bypass cache for /wp-admin/*: Cache Level > Bypass. Prevents admin dashboard from getting cached.
- Bypass cache for /wp-login.php: Cache Level > Bypass. Prevents login page from getting cached.
- Aggressive cache for /wp-content/uploads/*: Cache Level > Cache Everything, Edge Cache TTL > 1 month. Caches all your images at Cloudflare’s edge.
Free tier allows 3 page rules. That is exactly enough for a basic WordPress site.
Step 6: Install the official Cloudflare plugin for WordPress
In WordPress admin, install the “Cloudflare” plugin (by Cloudflare Inc.). Activate it and enter your Cloudflare API key (found in Cloudflare dashboard > My Profile > API Tokens). This plugin adds Cloudflare-aware cache purging (when you update a WordPress post, Cloudflare’s edge cache clears automatically for that URL).
Step 7: Verify everything works
Visit your site in an incognito browser. Right-click, Inspect, Network tab. Reload the page. Check the response headers. You should see:
cf-cache-status: HIT(means Cloudflare served from cache)cf-ray(Cloudflare request ID)server: cloudflare
If you see these, Cloudflare is working. TTFB should drop from 200-400ms (uncached) to 40-80ms (cached from Cloudflare’s edge).
Option 2: Cloudflare Enterprise via Cloudways ($5/mo)
Cloudways has a partnership deal with Cloudflare that gives you Enterprise-tier features on their platform for $5/mo per site (versus $200+/mo direct from Cloudflare). This is the best value in the entire hosting industry in 2026 if you have a real WordPress business.
What Enterprise adds over Free
- Argo Smart Routing: routes traffic through Cloudflare’s fastest paths, cuts TTFB by another 30% for PH visitors
- Image Optimization (Polish + WebP): auto-converts images to WebP, adds lossless compression at the edge
- Priority routing to 300+ edge cities (vs 150+ on free)
- HTTP/3 and QUIC by default (faster on mobile networks)
- Full page cache for logged-out users (aggressive caching automatically)
- Instant cache purge when Cloudways detects a WordPress content update
- SSL certificate from Cloudflare Enterprise (advanced negotiation options)
- Web Application Firewall (WAF) with WordPress-specific rules
Enterprise setup (Cloudways side)
- Log into your Cloudways account. Go to your application dashboard.
- Click on the CloudflareEnterprise tab in the left sidebar.
- Click “Enable Cloudflare Enterprise” and confirm the $5/mo charge.
- Cloudways provisions the Enterprise setup in under 5 minutes.
- Cloudways provides you with the Cloudflare nameservers.
- Update your domain registrar to use those nameservers (same as free option Step 2).
- Once propagated, Cloudways manages all Cloudflare configuration for you (page rules, SSL, cache purging).
No plugin needed. No API key required. Cloudways handles everything through their control panel.
Real 2026 performance comparison
Same WordPress site (Astra + 15 plugins) on Cloudways 2 GB. Tested 100 requests from Manila.
| Metric | Cloudways only | Cloudways + Free CF | Cloudways + Enterprise CF |
|---|---|---|---|
| TTFB (cached) | 180ms | 65ms | 32ms |
| Full page load | 1.1s | 0.7s | 0.5s |
| LCP | 0.9s | 0.6s | 0.4s |
| Image size (compressed WebP) | N/A | Manual conversion | Auto -40% size |
Enterprise cuts TTFB in half again over free Cloudflare. For revenue-generating sites, the $5/mo premium pays back through better conversion rates (Amazon showed every 100ms of latency reduction = 1% revenue increase).
Common issues and fixes
- SSL error after Cloudflare setup: SSL mode set to “Flexible” but your Cloudways origin has SSL. Change to “Full (strict)”.
- WordPress admin loops on login: Cloudflare caching wp-admin. Add a page rule to bypass /wp-admin/*.
- Comments not showing: form submissions cached. Add a page rule to bypass /wp-comments-post.php.
- WooCommerce checkout broken: cart pages cached. WooCommerce uses cookies for cart state that must not be cached. Add page rules to bypass /checkout, /cart, /my-account.
- Contact form 7 not sending: bot fight mode blocking form submissions. Whitelist your form endpoint in Cloudflare > Security > WAF.
Security features to enable in 2026
Beyond CDN, Cloudflare’s security features are worth turning on for any WordPress site:
- Bot Fight Mode (free): blocks known bad bots automatically
- DDoS Protection (free): always on, no config needed
- Rate Limiting (free: 10K requests/mo): protects wp-login.php from brute force
- Under Attack Mode (free): temporary JS challenge for all visitors during active DDoS
- WAF Managed Rules (free tier includes basic rules, Enterprise adds WordPress-specific rules)
Frequently asked questions
Do I need Cloudflare Enterprise if I already have Cloudways caching?
Cloudways caching is server-side (Varnish + Redis). Cloudflare is edge-side (CDN with global points-of-presence). They complement each other. Cloudways caching serves fast to visitors near your server (Singapore for PH visitors). Cloudflare serves cached content from 300+ cities globally, giving American and European visitors near-zero latency. Both together = best result. Free Cloudflare covers most needs. Enterprise adds smart routing that particularly helps mobile network users.
Will Cloudflare break my Elementor / Divi / WooCommerce site?
Only if configured incorrectly. Default free-tier Cloudflare (no aggressive caching rules) works with any WordPress builder or WooCommerce without issues. Problems come when developers set overly aggressive “Cache Everything” rules and forget to bypass wp-admin, checkout, and dynamic AJAX endpoints. Follow the standard page rules recommended above and you will not see breakage.
Is Cloudflare free tier really unlimited bandwidth?
Yes, Cloudflare has offered unlimited bandwidth on all tiers including free since 2010. There is no hidden cap for HTML/CSS/JS/image traffic. The catch is that video streaming, downloads over a few hundred MB, or unusual usage patterns may trigger a “commercial use of streaming” review, but for normal WordPress sites (even bandwidth-heavy image sites), Cloudflare free is genuinely unlimited.
Can I use Cloudflare with hosting other than Cloudways?
Yes, Cloudflare works with any WordPress host: Kinsta, WP Engine, Hostinger, Bluehost, DreamHost, self-hosted VPS. Setup steps are the same for the free tier. Cloudflare Enterprise integration at $5/mo is specifically a Cloudways deal. Kinsta has a similar Enterprise partnership at their own pricing. Other hosts require you to buy Cloudflare Enterprise directly (starts $200/mo).
Does Cloudflare affect my Google rankings?
Positively. Cloudflare improves Core Web Vitals (LCP, FID, CLS) via faster TTFB and global edge caching. Google uses Web Vitals as a ranking signal since 2021. Sites on Cloudflare typically see 200-400ms LCP improvement, which correlates with 5-10% ranking improvement for competitive keywords. Cloudflare’s SSL and DDoS protection also improve site security signals Google uses.
What if Cloudflare goes down globally?
Cloudflare has occasional global outages (roughly 1-2 per year, each 30 min to 2 hours). During outages, your site is unreachable through Cloudflare-proxied DNS. You can temporarily bypass Cloudflare by changing your DNS at Cloudflare to grey-cloud mode (no proxy) or by pointing your DNS directly at your origin server. Both take 5 minutes if you know the process. For 99.9% of the year, Cloudflare’s uptime is better than any single origin host.
Bottom line
Every WordPress site in 2026 benefits from Cloudflare in front. Free tier is a 15-minute setup that immediately cuts perceived load time and blocks bad bots. Cloudways users get the Enterprise upgrade for $5/mo, which pays back through better performance for revenue-generating sites. Start with free, upgrade to Enterprise when your site is doing real business. Do not skip this step, it is the highest-ROI hosting decision you will make in 2026.
Official documentation
Get started with Cloudways + Cloudflare
The links below are affiliate links. We may earn a commission at no extra cost to you when you sign up. See our affiliate disclosure for full details.
Leah Whynett Dela Pena
Technology Writer at PIES IT Solution
Leah Whynett Dela Pena is a technology writer at PIES IT Solution, author of 93 career and IT education guides at itsourcecode.com. Specializes in tech career paths (software engineering, web development, cybersecurity, IT analyst roles), degree and certification guidance, and IT industry how-to content for students and career changers.
Expertise: Tech Careers · IT Education · Web Development Careers · Software Engineering Careers · Cybersecurity Careers · IT Certifications · Career Guidance · View all posts by Leah Whynett Dela Pena →