Cloudflare security and performance settings for every plan

You have put a website or API behind Cloudflare, as a small-business owner, developer or DevOps engineer, and want the right settings for the plan you pay for. You get the baseline every plan includes, what Pro, Business and Enterprise add, a comparison table built only from Cloudflare’s own pages, commands to check your setup from outside, and a checklist per plan.

One rule runs through all of it: set up the baseline that every plan has first, then pay only for a gap you can name. Most of the settings that matter cost nothing, and an upgrade does not fix a free setting left wrong.

I set these up for clients through NoDowntime Technologies, my DevOps and incident response company in Dubai. This site, techiarvind.com, is a static site on an Apache origin behind Cloudflare, with HSTS preload set in Cloudflare and a strict Content Security Policy. Plan details were checked against Cloudflare’s pages on 11 November 2026; they change often, so each links to its source.

Security baseline for every plan

Cloudflare is moving zones to a new Security dashboard, where most toggles sit on one Security > Settings page with filters such as “Bot traffic”. Paths below use the page names from the current docs.

Full (strict), never Flexible

Set the encryption mode on SSL/TLS > Overview. Flexible sends plain HTTP from Cloudflare to your origin; Cloudflare says not to use it for anything with personal data or logins, and if the origin redirects HTTP to HTTPS, it causes a redirect loop. Full uses HTTPS but does not validate the origin certificate. Full (strict) validates it, and is the one to use.

The default, Automatic SSL/TLS, upgrades the mode gradually and never to a less secure one. Once the origin has a valid certificate, set Full (strict) yourself. A free Cloudflare Origin CA certificate works on every plan, but Cloudflare sends no expiry reminders for it, so note the date.

HTTPS everywhere and modern TLS

All on the Edge Certificates page, all plans:

• Always Use HTTPS: on. Do not also redirect at the origin, which can loop.
• HSTS: max-age options run from 1 to 12 months. Preload is the risky part: hstspreload.org requires a max-age of at least one year with includeSubDomains and preload, and removal takes months to reach users. Start short without preload, and raise it once every subdomain serves HTTPS. Turn on the No-Sniff header too.
• Minimum TLS Version: 1.2, unless you know a client needs older.
• TLS 1.3: on.

Keep the origin out of reach

Cloudflare only protects traffic that passes through it. Proxy every web record, then close the leaks Cloudflare’s origin guide lists: DNS-only records (including TXT and SPF) that contain the origin IP, mail on the same server (bounces reveal its IP), and historical DNS from before you joined. Run mail elsewhere and change the origin IP after onboarding.

Then make the origin refuse anything that skipped Cloudflare. Three layers, strongest last:

1. Firewall to Cloudflare’s ranges (ips-v4 and ips-v6). These are shared by every Cloudflare customer, so on their own they do not prove a request came from your zone.
2. Authenticated Origin Pulls, all plans. The global certificate is shared by all accounts; zone-level AOP with your own certificate is exclusive to yours.
3. Cloudflare Tunnel: cloudflared connects outbound only, so the origin needs no inbound listener. Each account includes 1,000 tunnels at no cost.

On an Ubuntu origin with ufw, after allowing SSH from your own address:

for cidr in $(curl -fsS https://www.cloudflare.com/ips-v4) $(curl -fsS https://www.cloudflare.com/ips-v6); do
  sudo ufw allow proto tcp from "$cidr" to any port 443 comment 'Cloudflare'
done
sudo ufw status numbered   # then delete any rule allowing 80 or 443 from anywhere

The Linux server hardening checklist covers the rest of the origin.

DNSSEC and CAA

Enable DNSSEC under DNS > Settings and add the DS record at your registrar (Cloudflare Registrar does it for you). When moving an existing domain, turn DNSSEC off at the old provider first, or validating resolvers return SERVFAIL.

Add CAA records on DNS Records. With Universal SSL, Cloudflare adds records for its own CAs once you add any CAA record. That does not cover Advanced Certificate Manager, so add your chosen CA yourself.

The WAF on the Free plan

• Free Managed Ruleset: deployed by default on Free, covering high-impact, widely exploited vulnerabilities.
• Custom rules: 5, every action except Log, no regex.
• Rate limiting: 1 rule, counting by IP over 10 seconds, blocking for 10 seconds, matching only on path and verified-bot status. A speed bump for a login path, not a lockout.
• Leaked credentials detection: on by default on Free, checking for leaked passwords. The “Add leaked credentials checks header” managed transform sends your origin an Exposed-Credential-Check header so the app can force a reset. The old Exposed Credentials Check ruleset is deprecated.

A good first custom rule limits an admin area to known addresses. For WordPress, with your IPs in place of the documentation ranges and Managed Challenge as the action:

(starts_with(http.request.uri.path, "/wp-admin/") or http.request.uri.path eq "/wp-login.php")
and http.request.uri.path ne "/wp-admin/admin-ajax.php"
and not ip.src in {203.0.113.10 198.51.100.0/24}

Bots, DDoS and challenges

DDoS protection is unmetered for layers 3 to 7 on every plan and works automatically.

Bot Fight Mode challenges simple bots from cloud providers and headless browsers across the whole domain. It cannot be skipped with custom rules or Page Rules, it “may challenge API or mobile app traffic”, and it switches on JavaScript detections, which need /cdn-cgi/challenge-platform/ allowed in your CSP. Use it on a blog or brochure site; leave it off on a zone serving an API, webhooks or an app.

Security Level is no longer yours to set. Since 17 March 2025 Cloudflare automates it: the old dashboard shows “Always protected”, the new one uses the setting only to switch Under Attack mode, and the threat score is always 0, so rules on cf.threat_score do nothing useful. Guides that say “set Security Level to High” are out of date.

Under Attack mode puts a Managed Challenge in front of every visitor. Cloudflare calls it a last resort during a layer 7 DDoS attack. It needs JavaScript, so API clients cannot pass it, and it disrupts analytics. Turn it on from Quick Actions on the zone overview, or for one path with a configuration rule, and off when the attack ends.

Turnstile replaces a CAPTCHA, free with unlimited challenges and 20 widgets. Validate every token server-side with the Siteverify API.

security.txt and injected scripts

Publish a security.txt from Security > Settings; it needs a contact and an expiry date.

Cloudflare does not modify your origin’s CSP header (Zaraz aside), yet several features inject scripts a strict CSP will block. Email Address Obfuscation is on by default and injects email-decode.min.js: allow it, wrap addresses in <!--email_off-->, or turn it off. Rocket Loader needs script-src 'self' ajax.cloudflare.com.

Performance baseline for every plan

Cache rules, not Page Rules

Page Rules are deprecated. Use Cache Rules: 10 on Free, 25 on Pro, 50 on Business, 300 on Enterprise. Cloudflare does not cache HTML or JSON by default, and Set-Cookie or Cache-Control: private, no-store, no-cache or max-age=0 stop caching. Below Enterprise, Origin Cache Control cannot be turned off, so your origin’s headers are the main lever. Rules stack, and the last matching rule wins, so put bypass rules last.

For WordPress, rule 1 makes public pages Eligible for cache, with Edge TTL “Use cache-control header if present, use default Cloudflare caching behavior if not”:

http.host eq "www.example.com"

Rule 2, placed after it, sets Bypass cache:

starts_with(http.request.uri.path, "/wp-admin/")
or http.request.uri.path eq "/wp-login.php"
or http.cookie contains "wordpress_logged_in"

The minimum Edge Cache TTL is 2 hours on Free, 1 hour on Pro and 1 second above. Browser Cache TTL defaults to 4 hours; choose Respect Existing Headers if your origin sends good ones.

Tiered Cache, protocols and compression

• Smart Tiered Cache (Caching > Tiered Cache): on. Misses go through one upper-tier data centre near your origin.
• HTTP/3 (Speed > Settings > Protocol Optimization): on.
• 0-RTT: requests can be replayed. Cloudflare allows it only for GET, HEAD and OPTIONS; leave it off if any GET changes state.
• Early Hints: on, but it only helps if your origin sends Link headers with preload or preconnect.
• Compression: Free gets Zstandard by default, Pro and Business Brotli, Enterprise Gzip; Compression Rules change it. The old Brotli toggle was deprecated in August 2024.

What is gone and what to leave off

• Auto Minify was deprecated on 5 August 2024. Minify in your build.
• Mirage was deprecated on 15 September 2025. Use loading="lazy" and srcset.
• Speed Brain, on by default on Free, prefetches the likely next page in Chromium 121 and later, but not with a CSP using strict-dynamic or nonces.
• Rocket Loader defers all JavaScript. Leave it off with a strict CSP or scripts already using defer, and turn it off first when scripts break.

Polish is not on Free, but image transformations are: 5,000 unique transformations a month under Images > Transformations. Past that, new ones return error 9422 and nothing is charged.

Pro: what it adds

Price: $20 a month billed annually, or $25 billed monthly.

1. Cloudflare Managed Ruleset. Turn it on and enable the rules tagged for your stack, not every rule. It makes the Free ruleset redundant.
2. OWASP Core Ruleset, optional. Cloudflare calls it “prone to false positives” with marginal benefit over the Managed Ruleset. If you use it, start at PL1 with the Low threshold (60 and higher, against a default of Medium, 40) and watch Security Events for a week.
3. 20 custom rules and 2 rate limiting rules (periods up to a minute, blocks up to an hour, matching on host and query too).
4. Super Bot Fight Mode. Turn off Bot Fight Mode first. Set “Definitely automated” to Managed Challenge or Block and allow verified bots. Leave static resource protection off unless needed; it can block good bots such as mail clients. “Likely automated” is not available on Pro, and with Cloudflare Tunnel, keep “Definitely automated” on Allow or tunnel connections can fail. Unlike Bot Fight Mode, a custom rule with the Skip action can exempt your API paths.
5. Leaked username and password pairs, via cf.waf.credential_check.username_and_password_leaked, to challenge logins that use a known leaked pair.
6. Polish: start with Lossless, then try Lossy with WebP.
7. Automatic Platform Optimization for WordPress is included (it is $5 a month on Free), and support moves to tickets.

Upgrade if visitors log in, buy or fill in forms, or you run a CMS or an image-heavy site. Stay on Free with a static site and no forms; there is little for the WAF to protect.

Business: what it adds

Price: $200 a month billed annually, or $250 billed monthly.

1. 100 custom rules with regex.
2. 5 rate limiting rules that match on method, source IP and user agent, run for up to 10 minutes, block for up to a day, and accept a counting expression. Cloudflare’s own example counts only failed logins:

Matching:  http.request.uri.path eq "/login" and http.request.method eq "POST"
Counting:  http.request.uri.path eq "/login" and http.request.method eq "POST" and http.response.code in {401 403}
Per IP, 4 requests per 1 minute, action Managed Challenge

3. Super Bot Fight Mode adds “likely automated” traffic and Bot Analytics. Start it on Managed Challenge.
4. WAF attack score class. Cloudflare’s get-started advice for Business is a rule on cf.waf.score.class eq "attack".
5. Custom certificates: 5 modern and 1 legacy pack, which you renew yourself.
6. A 100% uptime SLA with 1x service credits, PCI DSS 4.0 compliance and chat support.
7. Client-side security adds connection and cookie monitoring and alerts for new resources and domains.

Upgrade when you need the SLA in writing, rate limits that count failures, regex, more than 20 custom rules or your own certificates. Shops and payment pages are the usual case.

Enterprise: what it adds

Custom pricing on an annual contract, with many extras sold as add-ons:

• WAF: 1,000 custom rules, the Log action for testing rules before they block, account-level rulesets, full attack scores and the Sensitive Data Detection ruleset.
• Rate limiting: up to 100 rules by contract. Advanced Rate Limiting counts by headers, cookies, ASN, JA3/JA4 fingerprint, JSON fields or body.
• Bot Management: a 1 to 99 bot score on every request, replacing Super Bot Fight Mode. It acts only through your rules. Based on Cloudflare’s templates, with Managed Challenge:

cf.bot_management.score lt 30
and not cf.bot_management.verified_bot
and not cf.bot_management.static_resource

• API Shield for full API protection, and Spectrum on any TCP or UDP port (Pro and Business can only add it for SSH and Minecraft, Business also RDP).
• Caching: Regional and Custom Tiered Cache, cache keys by header or cookie, and control over Origin Cache Control.
• Support and visibility: 24x7x365 phone support, SLA credits of 10x or 25x, and 90 days of Security Analytics.

Add-ons that beat moving to Enterprise

Cloudflare has pledged to make nearly every feature buyable without a sales call, and several have moved. Check these first (plans page):

Need	Add-on	Price
Visitors far from the origin	Smart Shield + Argo Smart Routing	From $5 a month
Failover between origins	Load Balancing	From $5 a month
CA choice, Total TLS, cipher control	Advanced Certificate Manager	$10 a month
Malicious script detection	Client-Side Security	$0.099 per 1,000 requests
Logs in your SIEM	Logpush, on every plan since 30 September 2026	25 GB a month free, then $0.03 to $0.10 per GB

Cache Reserve is unclear: the plans page lists it as a usage-based add-on, but the Smart Shield docs say Smart Shield Advanced, which includes it, is not currently sold below Enterprise. Check your dashboard.

Move to Enterprise for Bot Management, Advanced Rate Limiting, API Shield, Spectrum on any port, or phone support.

Plan comparison

From Cloudflare’s plans page and documentation.

Feature	Free	Pro	Business	Enterprise
Monthly price	$0	$20 annual, $25	$200 annual, $250	Custom
Managed WAF rulesets	Free ruleset	+ Managed, OWASP	Same as Pro	+ Sensitive Data
WAF custom rules	5	20	100, regex	1,000, regex, Log
Rate limiting rules	1	2	5	Up to 100
Leaked credentials	Password	+ pairs	+ pairs	All fields
WAF attack score	No	No	Class only	Full
Bots	Bot Fight Mode	Super Bot Fight Mode	+ likely automated	Bot Management (add-on)
DDoS protection	Unmetered	Unmetered	Unmetered	Unmetered
Custom certificates	No	No	5 + 1 legacy	5 + 1 legacy, more
Uptime SLA	None	None	100%, 1x	100%, 10x or 25x
Support	Community	Tickets	Tickets, chat	24x7 tickets, chat, phone
Cache Rules	10	25	50	300
Minimum Edge TTL	2 hours	1 hour	1 second	1 second
Polish	No	Yes	Yes	Yes
Client-side security	Scripts	Scripts	+ connections, cookies	+ connections, cookies
Security Analytics retention	31 days	31 days	31 days	90 days
Logpush	Usage-based	Usage-based	Usage-based	By contract

Zero Trust for small teams, free

Cloudflare Access is free for up to 50 users, then $7 per user a month billed annually. Put admin panels, staging sites and dashboards behind an Access policy instead of a bare login page, and pair it with Cloudflare Tunnel so the app has no open inbound port at all.

Verify it from outside

Run these from outside your network, with your own domain:

# Expect server: cloudflare, HSTS, your CSP, h3 in alt-svc
curl -sI https://www.example.com/ | grep -iE '^(server|cf-cache-status|strict-transport-security|content-security-policy|alt-svc):'
# Run twice: expect HIT on a static file
curl -sI https://www.example.com/assets/site.css | grep -i cf-cache-status
# Expect a 301 to https
curl -sI http://www.example.com/ | head -n 1
# DNSSEC: DS at the parent, and "ad" in the flags from a validating resolver
dig +short example.com DS
dig @1.1.1.1 +dnssec example.com A | grep flags
dig +short example.com CAA
# TLS 1.3 should connect; TLS 1.1 should fail with a protocol version alert
openssl s_client -connect www.example.com:443 -servername www.example.com -tls1_3 </dev/null 2>/dev/null | grep '^New,'
openssl s_client -connect www.example.com:443 -servername www.example.com -tls1_1 -cipher 'DEFAULT:@SECLEVEL=0' </dev/null 2>&1 | grep -i alert

Keep @SECLEVEL=0: recent OpenSSL refuses TLS 1.1 on the client side, which would look like a pass. Also request the origin IP directly; behind the firewall it should time out.

Each week, check Security Analytics for all traffic, including requests Cloudflare let through, and Security Events for what it blocked or challenged, looking for false positives (Free shows sampled logs). Security Insights flags unproxied and dangling records, missing HSTS and old TLS, scanning every 7 days on Free, 3 on Pro and Business, and daily on Enterprise.

If the origin was reached directly, follow the first hour on a compromised Linux server. A static site can drop the origin by hosting on Cloudflare Workers, and young companies should check Cloudflare’s startup credits before paying for a plan.

Checklist by plan

Free

• Full (strict) with a valid origin certificate
• Always Use HTTPS, HSTS (preload last), TLS 1.2 minimum, TLS 1.3 on
• Every web record proxied, no origin IP in DNS, origin IP changed
• Origin locked to Cloudflare: firewall, zone-level AOP or Tunnel
• DNSSEC with DS at the registrar; CAA records
• Free Managed Ruleset, admin custom rule, login rate limit
• Bot Fight Mode only on zones without API or app traffic
• Turnstile on forms; security.txt published; CSP checked against injected scripts
• Cache rules with bypass last; Smart Tiered Cache, HTTP/3, Early Hints

Pro

• Cloudflare Managed Ruleset with your stack’s rules
• OWASP only if needed, at PL1 and Low
• Super Bot Fight Mode, with Skip rules for API paths
• Leaked-pair rule on login; Polish on Lossless

Business

• Rate limit counting failed logins
• Likely automated traffic challenged
• Rule blocking cf.waf.score.class eq "attack"
• Client-side security alerts going to a person

Enterprise

• New rules tested with Log first
• Bot score rule excluding verified bots and static resources
• Advanced Rate Limiting and API Shield on APIs
• Logs pushed to your SIEM