Cloudflare explained for business owners

At some point a developer, a hosting company or a friend who "does IT" will tell you to put your website on Cloudflare. It sounds like advice about security, or speed, or both, and it usually arrives with no explanation of what changes when you say yes.

Our own website runs on Cloudflare and we manage it ourselves. The domain sits on the free plan, and we pay for one thing on top: hosting the site itself, which comes to about $5.80 a month. This is the explanation we'd have wanted before we started: what the thing is, what it does for a business site, what it cannot do, and the handful of mistakes that turn a sensible change into a morning without email.

Why nobody explains it properly

Cloudflare is hard to describe because it does several unrelated jobs under one name. It can answer the question "where does this domain live?", it can stand in front of your website and handle visitors on its behalf, it can issue the padlock certificate, and it can host the website itself. Someone recommending it usually means one of those jobs, and rarely says which.

The name also covers a very large company selling to very large organisations. Much of what it publishes is written for their security teams, not for a shop owner in Westlands deciding whether a free account is worth an afternoon. So the explanation you get tends to be either a sales page or a single sentence: "it makes your site faster and safer." Both are partly true, and neither helps you decide.

The four jobs Cloudflare can do

It helps to take the jobs one at a time, because you can use some without the others.

1. It can run your DNS

DNS (the domain name system) is the internet's address book. When someone types your domain, DNS tells their phone which server to go to, and it also tells other mail servers where to deliver your email. Your domain's DNS lives somewhere, usually with the company you bought the domain from.

Moving your domain to Cloudflare means changing your nameservers at your registrar (the company you registered the domain with) so that Cloudflare answers those address-book questions instead. You keep the domain registered where it is. Ours is registered with a Kenyan registrar and has been the whole time; only the nameservers point to Cloudflare.

2. It can stand in front of your website

This is the job most people mean. Once Cloudflare runs your DNS, you can mark your website's records as "proxied". Cloudflare's own documentation describes it this way: when a record is proxied, Cloudflare sits between your visitors and your server. Visitors connect to Cloudflare, and Cloudflare fetches what it needs from wherever your site is actually hosted.

Two useful things follow. Your hosting server's IP (internet protocol) address, its numerical location on the internet, stops being public, which makes it harder to attack directly. And Cloudflare can keep copies of some of your files in its own data centres, which is what CDN (content delivery network) means, so images, fonts and style files reach visitors from somewhere closer than your host.

"Some of your files" matters. By default, Cloudflare does not cache HTML or JSON, which means the pages themselves, the text and structure of each page, still come from your host every time unless someone deliberately sets it up otherwise. It caches by file type: images, CSS (the style files), fonts, PDFs and similar.

3. It handles the padlock and absorbs attacks

The padlock in the browser bar comes from an SSL/TLS certificate (secure sockets layer and transport layer security, the technology that encrypts the connection). Cloudflare issues and renews these certificates free for domains that are active on it, covering the main domain and first-level subdomains such as www. Ours renews itself; we've never had to touch it.

It also provides DDoS (distributed denial of service) protection on every plan, including the free one. A DDoS attack is a flood of fake traffic meant to knock a site offline. Cloudflare's documentation lists "standard, unmetered DDoS protection" as included on the free plan, and it runs automatically.

4. It can host the website itself

This last job is optional and newer. Cloudflare can run the website's code directly, with no separate hosting company behind it. That's what we did with our own site, and it's the one job we pay for: it runs on the Workers Paid plan, listed at $5 a month, which comes to about $5.80 on our bill. We wrote up the reasoning, including the cases where it's the wrong choice, in why we built on Cloudflare instead of WordPress. Most businesses asking "should I use Cloudflare?" are asking about jobs one to three, in front of a site that lives somewhere else, and the rest of this post assumes that.

So do you need it?

Here is the test we'd use. It's our opinion, based on running our own site this way, and it's deliberately short.

You probably benefit if your site is on ordinary hosting (a WordPress site on a shared hosting plan is the common Kenyan case), you control your domain, and someone is willing to spend an hour setting it up carefully and knows where your email is hosted. The free plan's certificate, attack protection and file caching cost nothing (the free plan is listed at $0 a month) and ask little of you afterwards.

You probably don't need it if your site is on a hosted builder, where the builder already serves the site and handles the certificate. Putting another layer in front of a platform like that can conflict with how the platform works, so check the builder's own help pages before trying.

It won't fix a site that is slow because the pages themselves are heavy, the hosting is overloaded or the site does too much. Remember that pages still come from your host by default. If the diagnosis is "the server takes four seconds to answer", Cloudflare in front of it does little about those four seconds. And it won't fix a site that gets visitors but no enquiries; that's a different problem, covered in why your website isn't getting leads.

What it looks like on our own site

On 14 September 2026 we went through our own Cloudflare account setting by setting. The free plan already had most of the sensible defaults switched on: every visitor redirected to the secure version of the site, and the bot and browser checks running. The review still turned up changes worth making, and they're a fair picture of what "managing Cloudflare" involves for a small business.

We raised the minimum TLS version to 1.2, so browsers using the old, weaker versions of the encryption are refused. We added a rate limit in front of our contact form, so one source can't flood it with submissions. We switched on DNSSEC (domain name system security extensions, which lets other computers check that the DNS answers really came from us), a two-step job: turn it on in Cloudflare, then add a matching record at the registrar. And we turned on two-factor authentication for both the Cloudflare login and the registrar login, because whoever holds those two accounts controls the website and the email.

Two settings go the other way, deliberately. One of Cloudflare's AI crawler options had been adding instructions to our site telling AI crawlers to stay away, and we want answer engines to be able to read and cite us, so we switched it off. We also leave Hotlink Protection off, because our social media scheduler pulls post images straight from our site, and that setting would block it.

None of this was difficult. Each one needed someone to know the setting existed and to decide what the business actually wanted from it.

Common mistakes

Losing email during the move. Cloudflare scans your existing DNS records when you add a domain, but its own setup guide says the scan is not guaranteed to find all of them. If the email records (MX, or mail exchange, records, plus the verification records your email provider gave you) don't come across, your email stops arriving the moment the nameservers switch. Before moving, open your current DNS and check every record exists on the Cloudflare side. Email records also cannot be proxied and stay DNS-only, which is correct, so don't try to force them.

Picking "Flexible" encryption. Cloudflare offers several encryption modes for the connection between itself and your host. In Flexible mode the visitor sees a padlock, but the traffic from Cloudflare to your server is not encrypted. Cloudflare's page on Flexible says to use Full or Full (strict) instead if your site handles logins or personal data, and warns that Flexible on a host that already forces HTTPS creates a redirect loop that makes the site unreachable. If your host can serve a valid certificate, choose Full (strict).

Switching nameservers with DNSSEC still on. If DNSSEC is active at your registrar, Cloudflare says to turn it off before changing nameservers, because changing them while it's on can make the domain unreachable. Turn it back on through Cloudflare once the domain is active.

Letting the account belong to someone else. The Cloudflare account that holds your domain should be in the business's name, with the business's email, and with two-factor authentication on. If a developer sets it up under their personal login, you've handed them your address book. Ask for the account to be yours from day one, and for the developer to be added as a member of it.

Expecting it to make a slow site fast. Covered above, and the most common disappointment. Measure the site before and after so you know what actually changed.

Next steps

1. Find out where your DNS lives today. Your registrar's dashboard, or whoever built the site, can tell you. If nobody knows, that's the first thing to fix, with or without Cloudflare.
2. Write down where your email is hosted and screenshot every existing DNS record before touching anything.
3. Decide which of the four jobs you want. For most small business sites on ordinary hosting, that's jobs one to three on the free plan.
4. Create the account in the business's name with two-factor authentication on, then add the domain and check the imported records line by line against your screenshots.
5. Set encryption to Full (strict) if your host supports it, and send yourself a test email as soon as the nameservers switch.

Sources and further reading

Everything above about our own account is first-hand, from the review we ran on 14 September 2026. The platform claims come from Cloudflare's own documentation.

• How Cloudflare works, for Cloudflare as DNS provider and reverse proxy.
• Proxy status, on proxied versus DNS-only records and why email records stay DNS-only.
• Default cache behaviour, on what is and isn't cached out of the box.
• Universal SSL and encryption modes, for certificates and the Flexible warning.
• DDoS protection, for what the free plan includes.
• Workers pricing, for what hosting the site on Cloudflare costs.
• Full setup, for the nameserver change, the record review and the DNSSEC step.

Where we can help

Setting up Cloudflare properly in front of a site, with the email records checked and the account in your name, is part of how we build and look after business websites. If you want to see how it fits into a full build, we built this website with the same tools we sell walks through ours.

If someone has told you to "put it on Cloudflare" and you'd like a second opinion on whether it's worth doing for your site, book a 30-minute discovery call. Sometimes the honest answer is that your site doesn't need it, and we'll say so.