Adding Cloudflare's free tier in front of any VPS gets you: a real global CDN, DDoS protection, free SSL, and often a measurable page-load speedup. Setup takes 15 minutes. This guide is the complete walkthrough.

Why do this

• Real CDN. Static assets served from ~330 edge locations worldwide.
• DDoS protection. Free tier protects up to Layer 3/4 attacks; the paid tiers add more.
• Cache HTML for anonymous visitors. Huge speedup for content sites.
• Hide your VPS IP. Attackers see Cloudflare's edge, not your Hetzner IP.
• Free SSL. Even if your VPS doesn't have Let's Encrypt set up yet.
• Analytics. Basic traffic dashboards for free.

Total cost: $0/mo on the free tier.

Prerequisites

• A running VPS with your app answering on port 80 or 443.
• A domain name registered somewhere.
• 15 minutes.

Step 1: Sign up for Cloudflare

Go to cloudflare.com/sign-up. Free account. Verify email.

Step 2: Add your domain to Cloudflare

• Click "Add site."
• Enter your domain (e.g., yourdomain.com).
• Pick the Free plan.

Cloudflare will scan your existing DNS records at your current registrar.

Step 3: Update DNS records

Cloudflare shows your current DNS records. Review them:

• Your VPS should have an A record pointing at your VPS IP. Click the cloud icon to make it orange (proxied through Cloudflare). This is where the magic happens.
• www subdomain should also be orange-clouded.
• MX records for email (if any) should stay grey-clouded — email doesn't go through Cloudflare's proxy.

Step 4: Change your domain's nameservers

Cloudflare gives you two nameserver hostnames (e.g., dave.ns.cloudflare.com and chloe.ns.cloudflare.com). Copy these.

Go to your domain registrar (Namecheap, Cloudflare Registrar, Namesilo, etc.) and change the nameservers to Cloudflare's two. Save.

DNS propagation takes 1-24 hours. Usually 15 minutes to 2 hours in practice.

Step 5: Wait for Cloudflare to activate

Cloudflare will send you an email once the nameserver change propagates and the domain is fully proxied through them. Until then, the site works normally through your existing DNS.

Step 6: Configure SSL

In Cloudflare dashboard → SSL/TLS:

Set encryption mode to "Full (strict)". This means Cloudflare verifies your VPS's SSL certificate. Your VPS needs a valid cert.

If your VPS doesn't have a Let's Encrypt cert yet: install one with Certbot before enabling Full (strict), OR use Cloudflare's Origin CA to issue a cert your VPS can use.

Enable "Always Use HTTPS" so HTTP requests redirect to HTTPS at the edge.

Enable "Automatic HTTPS Rewrites" to fix mixed-content warnings.

Step 7: Configure caching (for content sites)

In Cloudflare dashboard → Caching → Configuration:

Standard cache is on by default. Cloudflare caches CSS, JS, images, fonts automatically.

To cache HTML (real speedup for content sites, do NOT enable if your site has logged-in users seeing personalized pages):

• Go to Rules → Page Rules → Create Page Rule.
• Match: yourdomain.com/
• Setting: Cache Level = Cache Everything and Edge Cache TTL = 2 hours (or shorter).

Test carefully. If your site has any logged-in area, exclude those paths via more specific page rules.

Step 8: Security settings

In Cloudflare dashboard → Security:

Security Level: Medium (default is fine).

Bot Fight Mode: On (free feature that blocks common bad bots).

Under Attack Mode: Off (only turn on during an active DDoS).

Step 9: Firewall your VPS

Now that Cloudflare is proxying, restrict your VPS firewall to only accept traffic from Cloudflare's IPs:

```bash

Get Cloudflare's IP ranges

curl -s https://www.cloudflare.com/ips-v4 -o /tmp/cf-v4.txt

curl -s https://www.cloudflare.com/ips-v6 -o /tmp/cf-v6.txt

Allow only Cloudflare on 443

ufw delete allow 443/tcp

for ip in $(cat /tmp/cf-v4.txt); do

ufw allow from $ip to any port 443

done

ufw reload

```

Now direct requests to your VPS's IP get dropped; only requests through Cloudflare reach your app.

Refresh your Cloudflare IP allowlist monthly or use a systemd timer to keep it fresh (fail2ban package has good patterns for this).

Step 10: Verify

• Visit https://yourdomain.com in an incognito window.
• Check response headers: look for cf-ray: (Cloudflare's request ID) and cf-cache-status: HIT on cached assets.
• Check whatsmydns.net — your domain should resolve to Cloudflare's IPs, not your VPS IP.
• Look up your VPS IP directly (https://YOUR.VPS.IP.HERE/) — should now fail or timeout since firewall drops non-CF traffic.

Common gotchas

"Too many redirects" after enabling Full (strict). Means your VPS isn't serving HTTPS properly. Install Let's Encrypt on your VPS: certbot --nginx -d yourdomain.com.

Static assets not cached. Cloudflare respects Cache-Control headers from your origin. Set long cache times for static assets:

```nginx

location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2)$ {

expires 1y;

add_header Cache-Control "public, immutable";

}

```

Real visitor IP shows as Cloudflare IP in logs. Cloudflare adds a CF-Connecting-IP header with the actual visitor IP. Configure Nginx to use it:

```nginx

in nginx.conf http block

set_real_ip_from 103.21.244.0/22;

... more Cloudflare IP ranges (get from cloudflare.com/ips)

real_ip_header CF-Connecting-IP;

```

WordPress admin slow. Bypass Cloudflare cache for /wp-admin/* via page rule.

Email delivery broken. Cloudflare doesn't proxy email. Ensure MX records are grey-clouded (not orange).

Beyond the free tier

Cloudflare Pro ($20/mo) adds: Image resizing, mobile optimization, WAF managed rulesets, higher analytics resolution.

Cloudflare Business ($200/mo) adds: 100% uptime SLA, priority support, custom SSL certs, prefetching.

Cloudflare Enterprise — negotiated pricing, includes Argo routing, better cache hit rates, custom rules. Kinsta and Rocket.net bundle Enterprise with their managed WordPress plans.

For 95% of small production sites, the free tier is legitimately enough.

Related guides

• Best hosting for a WordPress site — where Cloudflare fits.
• How to host a Next.js app on a $5 VPS — includes Cloudflare setup.
• Managed WordPress to VPS + Nginx migration — includes Cloudflare as part of the migration.