traffic is filtered

Not everything that hits a website is a person. Most of it is not. Scanners looking for known holes, scripts trying passwords, bots scraping content, and the occasional flood of requests meant to knock a site over. A site sitting on a rented server takes all of that on the chin, because the server has to answer every request to find out whether it was worth answering.

Traffic is filtered means that job moves to Cloudflare. Every request for your domain passes through their network first. Requests that match known attack patterns are dropped. Requests from addresses with a history of abuse are dropped. Floods are absorbed across hundreds of data centres instead of piling up on one machine. What reaches your site is the traffic that is left: real people, and the search engines you want.

This is one of the things you get simply by being behind Cloudflare. It is not a plugin, not a subscription, and not something that needs updating.

Why it matters to you

The site I was asked to rebuild for a trades business had been broken into through a WordPress plugin. The break-in did not start with a clever hacker. It started with an automated scanner that visited every site it could find, checked for that plugin, and found it. That scanner never should have been able to talk to the server in the first place.

Filtering removes that first step. The scanners still exist. They just do not reach you. That cuts the noise on the server, cuts the odds of a successful attack, and cuts the risk of your site being slow because it is busy answering junk.

It also means a bad day on the internet is not your bad day. A flood of requests aimed at your domain is soaked up by the network. Your site keeps loading for the customers who matter.

How I set it up

There is very little to set up. Once the domain’s nameservers point at Cloudflare, the filtering is on. I check that the security level is sensible, turn on the managed rules that block common attack patterns, and make sure search engine crawlers are allowed through. That takes minutes, and I do it once.

On the sites I build, filtering is only the first layer. The site itself is a static site with nothing to break into: no plugins, no admin login, no database behind a form. Every page also carries a set of security headers that tell the browser what it may and may not do. Filtering keeps the crowd out. The rest makes sure there is nothing worth getting to even if someone slips through.

What it looks like in practice

You do not see it. Your visitors do not see it. The Cloudflare dashboard shows a count of requests that were blocked or challenged, and on a normal small business domain that number is a meaningful share of the total. It is usually a surprise to owners how much of what arrives at their address was never a person.

Once in a long while, a visitor on a strange network might get a page asking them to confirm they are human. One click and they are through. I have never had a client lose a lead to it. I have had clients lose a whole site to what filtering stops.