Somebody told you to "put the site behind Cloudflare," and you nodded like you knew what that meant. You are not alone. Cloudflare sits in front of a huge chunk of the internet, and most business owners who use it could not say what it actually does. Here is the plain-English version, because you should understand anything that sits between your customers and your website.
The one-sentence version
Cloudflare is a middleman between visitors and your web server. Instead of people connecting straight to your server, they connect to Cloudflare, and Cloudflare talks to your server on their behalf. Everything Cloudflare does flows from sitting in that position.
DNS: the address book
DNS is the system that turns a name like yourcompany.com into the numeric address of a server. Every domain needs a DNS provider, and Cloudflare is one of the best free ones. Their DNS is fast, changes take effect in minutes instead of hours, and the dashboard is clear enough that you can see every record your domain has in one screen.
This matters more than it sounds. When we untangle a client's setup, half the time the DNS records live at some registrar they forgot the password to. Moving DNS to Cloudflare puts your domain's address book somewhere fast, free, and easy to audit. This is usually the first thing we do with a client's domain even if they use nothing else Cloudflare offers.
CDN: copies of your site, closer to your visitors
CDN stands for content delivery network. Cloudflare runs data centers in hundreds of cities, and it keeps copies of your site's static files, meaning images, stylesheets, scripts, and sometimes whole pages, in all of them. When someone in Seattle visits your site, they get those files from a server near Seattle instead of from your web host in Virginia.
Two things happen as a result. Your site loads faster, especially for visitors far from your host. And your actual server does less work, because Cloudflare answers a large share of requests from its own copies. For a typical small-business site, most of the traffic never touches your server at all. That also means a traffic spike, from an ad campaign or a news mention, is far less likely to knock you over.
DDoS protection: absorbing the flood
A DDoS attack is when someone points thousands of hijacked machines at your site and floods it with junk traffic until it falls over. Small businesses assume they are too small to be a target. They are wrong. Attacks get launched over petty disputes, extortion attempts, and sometimes just automated scanning that happens to hit you.
Because all traffic goes through Cloudflare first, the flood hits their network instead of yours. Cloudflare's network is enormous, and absorbing this kind of garbage is their core business. The junk gets filtered out and real visitors get through. This protection is included even on the free plan, and it works because of that middleman position: attackers hit the shield, not the server behind it.
Related to this, Cloudflare hides your server's real address. Visitors only ever see Cloudflare's addresses, which makes it harder for attackers to go around the shield and hit your server directly.
Certificates and HTTPS
Cloudflare also handles the padlock. It issues and renews the certificate that gives you HTTPS, automatically, at no cost. Expired certificates are one of the most common "the website is showing a scary warning" calls we get, and putting a site behind Cloudflare makes that entire category of problem mostly disappear. One caution: the encryption mode needs to be set correctly (Full, not Flexible) so traffic is encrypted the whole way to your server and not just to Cloudflare. This is a two-minute setting that a lot of DIY setups get wrong.
Workers: small programs at the edge
Workers are Cloudflare's way of letting you run code on their network instead of on your server. You will hear developers get excited about this. For a small business, the practical uses are modest but real: redirecting old URLs after a site rebuild, adding security headers, or running a small API without renting a server for it. If you do not have a developer, you will probably never touch Workers, and that is fine. They are there when you need them.
What Cloudflare does not do
Cloudflare does not host your website. Your site still lives on a web host somewhere, and if that host goes down, Cloudflare mostly goes down with it for your visitors. It does not back up your site. It does not fix a slow database or a bloated WordPress install, although caching can hide some of the symptoms. Think of it as armor and a delivery service, not a foundation.
What it costs and how to know it is set up right
The free plan covers everything above and is genuinely enough for most small-business sites. Paid plans, starting at roughly twenty dollars a month, add a proper web application firewall, image optimization, and better analytics.
A correct setup looks like this: your domain's DNS lives at Cloudflare, the important records have the orange cloud turned on so traffic is actually proxied, encryption mode is Full, and your web host is configured so it only accepts traffic from Cloudflare. If any of those are off, you have the dashboard but not the protection. We set this up for clients in an afternoon, and it is one of the highest-value afternoons in IT.
Stuck on this, or want it done for you? That's the job.
Email us →