Cloudflare Rules for WordPress (2025): Security, Cache Bypass, and APO Tips

Surprising fact: a properly configured edge CDN can cut server time-to-first-byte by over 60% for global visitors.

You manage a site that must be fast and secure without breaking admin pages or dynamic features. If your host offers an integrated service (examples include managed hosts that handle dashboard settings), you may not need to tweak much yourself.

Quick baseline: use SSL/TLS Full (Strict), Always Use HTTPS, HSTS for 6–12 months, TLS 1.3, Brotli ON, Early Hints ON, HTTP/3 with QUIC ON, and leave Rocket Loader off for most sites.

The CDN’s APO serves HTML at the edge and speeds up page delivery, but keep your origin cache plugin active so your server still handles origin-level caching.

Use cache-bypass logic for wp-admin, previews, AJAX and lock down login entry points to reduce junk traffic. Consider Argo and Tiered Cache for global audiences and expect small trade-offs like Email Obfuscation injecting a tiny script into waterfalls.

• Start with host-managed settings; only edit the dashboard when needed.
• Enable APO or Cache Everything carefully; keep origin cache plugin active.
• Apply Full (Strict) TLS, HSTS, TLS 1.3, Brotli, and Early Hints for quick wins.
• Bypass cache on admin, previews, AJAX; lock wp-login and xmlrpc.php.
• Use Argo and Tiered Cache when your audience is global, not purely local.

A global CDN moves heavy work off your origin so your website feels faster to every visitor. You will see lower time-to-first-byte and fewer network hops. That improves page load and real-world performance.

Keep your origin safe while scaled traffic hits the edge. DDoS protection and a WAF filter bad requests before they reach your server. Free SSL/TLS keeps connections encrypted and simple to manage.

Caching static assets at points of presence speeds repeat visits. The WordPress plugin clears cache automatically when you update content so changes show up fast. APO-like features accelerate dynamic pages while targeted bypass prevents admin and preview pages from being cached.

• Stay online: load balancing and failover preserve responsiveness during spikes.
• See what matters: analytics show requests, visitors, bandwidth, and threat blocks.
• Modern transport: HTTP/3 and protocol upgrades shave milliseconds off load times.

Before you change anything, verify how your host handles CDN and security features. Some hosts (Rocket.net Enterprise stacks, Cloudways, Kinsta) manage most settings for you. If your host does this, avoid duplicate dashboard tweaks that create conflicts.

Confirm DNS and nameservers first. Keep your domain pointed to the provider’s nameservers and set key records to proxied (orange cloud) to unlock WAF, APO, and edge tools. This also ensures your site gets protection and acceleration.

Install and activate the official Cloudflare plugin by Cloudflare, Inc. Then connect using your cloudflare account credentials: either a Global API Key or a scoped API token saved under Settings > Cloudflare. Enable Auto Purge on Update so pages refresh when you edit posts or pages.

• Use Development Mode during theme or code work to bypass edge cache.
• Keep your server/page cache plugin active while using APO; they operate at different layers.
• Document baseline settings, secure API credentials, and rotate them when users change.
• If you manage multiple domains, repeat the plugin setup per site and verify proxied DNS records.

Open the dashboard to get a quick snapshot of traffic, caching, and active protections for your site. The Overview page shows how many requests hit the edge, the bandwidth split (cached vs. uncached), and unique visitors. This helps you spot spikes and measure caching effectiveness.

Under Attack Mode raises challenge screens when a DDoS is active. Toggle it only during real incidents so normal users keep access.

Development Mode disables edge caching for three hours so you can view live changes to templates, CSS, and scripts. Use it while you test edits and then switch it off.

Use the Overview to check how many requests are being handled and how much bandwidth you save via caching. Compare the cached vs. uncached split to see if your site is edge-optimized.

• Monitor unique visitors to correlate promos or seasonality with traffic.
• Use quick actions to purge everything after a big deploy, but prefer targeted purges for precision.
• Watch request counts and bandwidth day-over-day to catch anomalies early and adjust settings.

Favor data-driven changes: if uncached bandwidth spikes, review your page settings, APO or cache-level decisions, and any firewall rules. Keep a short log of what you change and when so you can map performance swings to a specific number of actions.

A precise DNS setup is the foundation that keeps your site fast and safe. Point your domain to the provider nameservers to enable the dashboard and edge acceleration. This step also allows WAF, caching, and other protection layers to work.

Orange cloud vs. DNS-only: mark hostnames you want proxied to route traffic through the CDN and WAF. Leave mail and services that rely on specific ports DNS-only to avoid breaking protocol-dependent tools.

Enable DNSSEC to add cryptographic signatures and prevent spoofing. Audit A, AAAA, and CNAME records so the right hostnames are proxied. Use TXT records for verification and email SPF/DKIM/DMARC—these do not affect web traffic.

• Document origin server IPs and reduce direct exposure.
• Test resolution and TTLs after changes to confirm propagation across the network.
• List performance-critical subdomains and proxy only those to avoid breaking auxiliary tools.

Make sure your site enforces end-to-end encryption from the visitor browser to your origin server. Start with an origin certificate and pick Full (Strict) so the edge validates that cert and preserves a secure connection to your server.

Then enable these settings:

• Always Use HTTPS to redirect http requests to HTTPS at the edge.
• HSTS set for 6–12 months, include subdomains and consider preload only after verifying every host serves HTTPS.
• TLS 1.3 ON and Minimum TLS version ≥ 1.2 to use modern protocol benefits while avoiding deprecated ciphers.
• Automatic HTTPS Rewrites to fix mixed content by rewriting http assets to https on the fly.

Use Certificate Transparency Monitoring to get alerts on new certs and spot unauthorized issuance of certificates for your domain.

Check response headers like HSTS and X-Content-Type-Options after changes. Re-test critical pages and embedded scripts so no insecure asset remains in templates.

Taming automated scrapers and credential stuffing is the quickest way to lower server load. Start by turning on managed WAF presets to block common exploits like SQLi and XSS. Then add WordPress-focused custom rules to catch plugin and theme patterns that the managed sets miss.

Practical firewall moves:

Keep WAF managed sets active so known threats stop at the edge.

Create a few targeted custom rules for admin POSTs and suspicious query strings. Use Security Level at Medium or High to challenge sketchy IPs while avoiding friction for normal users.

Block, challenge, or rate-limit requests to /wp-login.php. If you don’t need xmlrpc.php, disable or forward it behind a challenge to prevent pingback DDoS.

Allowlist your team IPs so trusted admins never get blocked during an emergency.

Enable Bot Fight Mode to push back scrapers and credential-stuffers that waste bandwidth and server cycles.

Keep Browser Integrity Check on to drop requests with malicious headers before they reach your application.

• Review Firewall Events regularly to spot repeat offenders.
• Use analytics before blocking countries; avoid cutting off real traffic.
• Revisit rules after big plugin or theme changes—new endpoints may need protection.

A clear TTL plan keeps your edge cache hot and your origin server out of extra work.

Start by deciding whether to respect existing headers or set your own browser cache values. If your origin server already sends sane headers, choose Respect Existing Headers. That avoids fighting your app’s intent. If it doesn’t, set a long Browser Cache TTL for static assets (Google suggests up to one year for images and fonts).

Use Edge Cache TTL to keep frequently requested assets closer to visitors. Longer edge TTLs reduce origin pulls and boost site performance.

Cache Everything can speed HTML, but apply it sparingly. Always pair it with bypass patterns for admin, login, previews, and AJAX. For eCommerce, bypass cart and checkout flows to avoid stale content and user confusion.

• Let Origin Cache Control rule if your app emits granular headers.
• Tune TTLs per asset type: long for images/fonts, shorter for CSS/JS you deploy often.
• After purges, revalidate key pages to warm caches and cut first-visit latency.

Start by locking down behavior at the page level so dynamic parts of your site never serve stale content. Create high-priority page patterns that match admin, preview, and AJAX endpoints. Only the top matching rule applies, so specificity matters.

Bypass cache for wp-admin, previews, and AJAX

• Add a high-priority rule for /wp-admin* that bypasses cache, disables Apps/Performance, and sets Security Level to High.
• Also bypass /preview* and /ajax* so editors and dynamic widgets always get fresh responses.

• Force HTTPS with an Always Use HTTPS page rule for http://*example.com/* if you need domain-specific redirects.
• Forward /xmlrpc.php* to the homepage with a 301 if you don’t use it to stop brute-force vectors before they hit your server.
• Cloak affiliate links via Forwarding URL rules and use $1 placeholders to keep dynamic slugs intact.

Email Obfuscation on contact pages without breaking performance

Enable email obfuscation only on your contact page to hide addresses from harvesters. This adds a small email-decode.min.js script, so limit it to the few pages that need protection.

• Set Edge Cache TTL and optional Cache Everything on /wp-content/uploads* and keep a reasonable Browser Cache TTL for visitors.
• Order rules from most to least specific and test with real URLs so only the intended page rule fires.
• Watch wildcard placeholders closely and never redirect a path to itself to avoid loops. Keep a changelog of edits for fast troubleshooting.

Enable edge HTML delivery to shave milliseconds off global page loads and keep dynamic areas fresh.

APO serves HTML at the edge while your origin retains control. Enable APO in the plugin after authenticating your cloudflare account and confirm key pages show edge headers. This cuts TTFB and helps LCP for distant visitors.

Do not stack “Cache Everything” on top of APO. APO already handles HTML; layering cache-everything rules risks stale admin pages, previews, carts, and AJAX endpoints. Use precise bypass patterns instead.

Keep your origin server cache plugin active. APO handles edge caching, while your plugin manages origin caching and clears local caches on updates. They complement each other when configured properly.

Turn on SXG if your plan supports it. Signed Exchanges can speed perceived rendering from search results and pair well with APO for organic clicks.

Benchmark before and after using PageSpeed Insights and KeyCDN Performance Test. Compare TTFB and LCP to verify real improvements.

After theme or plugin updates, purge edge cache and consider a warm-up crawl for priority pages. Confirm edge headers on responses so you know pages were served from the edge and not the origin.

• Watch personalization: check cookie-based pages and add exceptions for logged-in users.
• Rollback plan: disable APO briefly if something breaks to isolate issues.
• Reassess: revisit settings and purging strategy as your site and traffic patterns change.

Small transport and scheduling changes can cut real-world load times and reduce work on your origin server. Turn on modern transport features to let the network and browser do more of the heavy lifting.

Enable Brotli to compress text assets more efficiently than gzip. That reduces payload size and makes pages load faster for desktop and mobile visitors.

Flip on HTTP/3 with QUIC and Enhanced HTTP/2 Prioritization so the browser can schedule resources better and the network reduces head-of-line blocking.

Use TCP Turbo to auto-tune transport parameters on flaky routes and lower round-trip overhead.

Leave Rocket Loader off unless you test thoroughly. It can break themes and plugins and many cache plugins recommend disabling it.

Argo can route traffic over faster network paths and reduce latency for distant visitors.

Pair Argo with Tiered Cache so POPs share assets and protect your origin server from repeated pulls. This setup helps global sites more than local ones.

Zaraz offloads third-party scripts (analytics, pixels) and reduces main-thread blocking in the browser. Moving tracking into Zaraz often improves Core Web Vitals.

“Measure changes with PageSpeed Insights and KeyCDN; don’t assume a transport tweak is always a win.”

• Set sensible cache ttl for static assets and confirm browser cache headers match your deploy cadence.
• Verify Tiered Cache is enabled so edge POPs re-use assets and cut origin hits.
• Re-test performance and network metrics after each tweak to validate the data.

Start by verifying hits and misses so you know whether the edge or the origin handled each page view. Use analytics to compare cached vs. uncached bandwidth and the number of requests over time. That data shows whether your cache TTL and browser cache settings are working.

Look at request counts, unique visitors, and blocked events. Security analytics tells you which bots were challenged and which attacks the WAF stopped.

Review DNS analytics to confirm your records are proxied. If DNS isn’t routed through the edge, page-level rules won’t fire and diagnostics will mislead you.

Audit page rule order: only the highest-priority match applies, so order from most to least specific.

• Inspect response headers to see HIT, MISS, or BYPASS and confirm TTL logic via headers.
• Validate wildcard placeholders like $1 and $2. A mismatch can return HTTP 500s.
• Keep a runbook for mixed content, redirect loops, stale admin pages, and APO conflicts.

“Use analytics first, then act—data fixes guesswork.”

Test changes in Development Mode or staging. Track who edited settings, the date, and which account made the change to speed root-cause analysis when things break.

,Tie everything together by documenting settings, verifying headers, and testing real user flows.

Recap: keep DNS proxied, lock SSL/TLS to Full (Strict), enable HSTS and TLS 1.3, and use APO or edge HTML to speed page delivery. Turn on Brotli, Early Hints, and HTTP/3 so your site serves faster to visitors and reduces server load.

Fine-tune page level bypasses for admin, previews, and AJAX. Consider Argo + Tiered Cache if traffic is global. Offload third-party scripts to Zaraz and use Email Obfuscation only where needed to avoid extra JS.

Act: measure with analytics, document your cloudflare settings and purge/warm key pages after big updates. Revisit quarterly to keep security and optimization aligned with real-world traffic.