behind Cloudflare

When people say a domain is behind Cloudflare, they mean that Cloudflare answers for it. Type the address, and the first thing your browser talks to is a Cloudflare data centre, not the machine that holds the site. Cloudflare decides whether to serve the page from its own copy, block the request, or pass it along.

That position, in front of everything, is what makes the rest possible. Because every request goes through Cloudflare, it can filter out attacks and scrapers before they reach anything. Because Cloudflare is the one talking to the browser, it can hold the certificate that turns on HTTPS and renew it without anyone remembering to. And because the domain’s DNS is in the same account, all of it is managed in one place that you own.

For the sites I build, there is nothing behind Cloudflare at all in the old sense. The site itself lives on Cloudflare’s network as a set of files. Behind Cloudflare and on Cloudflare are the same thing.

Why it matters to you

A domain that is not behind anything is exposed. Every scanner, bot and bored teenager on the internet can talk directly to the server that holds your site. Most of the successful break-ins I have cleaned up started that way: a WordPress plugin with a known hole, sitting on a shared server that anyone could reach.

Putting the domain behind Cloudflare closes the front door. Requests that look like attacks are dropped. Requests from known bad sources never arrive. The traffic that does get through is real people and legitimate search engines. That is what traffic is filtered means.

It also means the certificate is never your problem again. Expired certificates are one of the most common reasons a small business site suddenly shows a scary browser warning. Behind Cloudflare, the certificate renews itself.

How I set it up

The domain’s nameservers are pointed at Cloudflare. That is the whole mechanism. From that moment, Cloudflare is the authority for the domain and every request for it passes through their network. If the domain is registered somewhere else, the registrar stays where it is and only the nameservers change. If you want the domain moved into Cloudflare too, so that renewals and DNS are in one place, I do that as well.

I do this in a Cloudflare account that belongs to the business, not to me and not to a vendor. You hold super admin. On one recent job, six domains across three related businesses all moved behind Cloudflare in a single account, so the owner could see every one of them on one screen instead of chasing a provider who held them hostage.

What it looks like in practice

Nothing changes for your visitors except that the site is faster and shows the padlock. Behind the scenes, the Cloudflare dashboard shows how much traffic arrived, how much was blocked, and where it came from.

If a vendor ever tells you that your site has to stay on their server or it will stop working, that is what behind Cloudflare protects you from. The address, the DNS and the shield in front of the site are all yours. The server, if there even is one, is the least important part.