Cloudflare — a guide to the main tabs

Overview

Your domain's home base. This tab gives you a bird's-eye view of encryption status, caching, and general settings. The right column has a few quick-toggle features worth knowing:

• Under Attack Mode — adds a challenge page that visitors must pass before reaching your site, buying time against DDoS floods. Once enabled, you can dial the protection level from low to high.
• Development Mode — temporarily disables caching so your changes show up instantly. Essential when you're actively making updates and don't want to be staring at a stale version of your site.
• Purge Cache — wipe the entire cache, or target specific files.
• DNS Settings — manage your domain's DNS records.

Analytics

A surprisingly capable traffic dashboard — detailed enough to replace a dedicated analytics tool for many use cases.

• Requests — request volume, cache hit rates, visitor geography, and more.
• Bandwidth — total outbound traffic from your site.
• Unique Visitors — distinct visitor counts over time.
• Threats — malicious requests broken down by threat type and country of origin.

DNS

Your full DNS record list, plus a couple of extras:

• Custom Nameservers — create branded nameservers for your domain. Paid feature.
• DNSSEC — cryptographically signs your DNS zone to prevent spoofing and cache poisoning. Visitors can be confident the DNS records they receive are the real ones.
• CNAME — maps a subdomain to another domain. The go-to record type for pointing things like www or blog elsewhere.

SSL/TLS

Controls how traffic is encrypted between visitors, Cloudflare, and your server.

Mode	What it does
Off	No encryption — traffic travels in plain text
Flexible	Encrypts the browser-to-Cloudflare leg only; Cloudflare-to-server is unencrypted
Full	End-to-end encryption using a self-signed certificate on your server
Full (Strict)	End-to-end encryption requiring a trusted SSL certificate or a Cloudflare Origin Certificate on the server

Firewall

Fine-grained access control based on IP, country, or request type.

• Rate Limiting — automatically blocks IPs that exceed a request threshold, useful against scrapers and brute-force attempts. First 10,000 requests are free; $0.05 per 10,000 after that.
• Security Level — a global sensitivity dial ranging from low to high.
• Challenge Passage — sets how long a visitor who passed a challenge can browse without being re-challenged. Ranges from 5 minutes to 1 year.
• Access Rules — create custom allow/block rules scoped to individual IPs, ASNs, or entire countries. Options include blocking, whitelisting, JS challenge, and more.

Access

Protect internal tools and applications behind Cloudflare authentication — no VPN required.

Speed

Analyze and improve your site's load time.

• Auto Minify — strips whitespace and comments from JavaScript, CSS, and HTML to reduce file sizes.
• Polish — compresses and optimizes images, with optional WebP conversion.
• Railgun™ — speeds up delivery of dynamic, uncacheable content.
• Mobile Redirect — automatically sends mobile visitors to a dedicated mobile-optimized version of your site.

Caching

Control what gets cached and for how long.

• Purge Cache — clear everything at once, or surgically remove specific files.
• Caching Level — tune how aggressively Cloudflare caches your content.
• Browser Cache Expiration — tells browsers how long to hold onto cached assets locally. Configurable from 2 hours up to 1 year.

Network

Low-level protocol and network settings.

• HTTP/2 + SPDY — enables modern transport protocols for faster page loads.
• IPv6 Compatibility — allows IPv6 clients to reach your site.
• Pseudo IPv4 — injects an IPv4 header into IPv6 requests for servers that only speak IPv4.
• IP Geolocation — automatically routes visitors to a regional version of your site where one exists.
• Maximum Upload Size — caps the size of files that can be uploaded through your site.
• Response Buffering — controls whether Cloudflare buffers responses from your origin. Enterprise plans only.

Traffic

Higher-level traffic management and routing.

• Argo — routes traffic through Cloudflare's fastest available network paths to cut latency.
• Load Balancing — distributes traffic across multiple origin servers with automatic failover, geo-routing, and health checks.

Apps

One-click integrations and add-ons from the Cloudflare marketplace.

• Drift — adds a live chat widget to your site. Free tier has limitations.
• Google Analytics — drop in GA tracking without touching your source code.
• Lead Box — adds an email subscription form. Free tier has limitations.
• Detectify — scans your site for security vulnerabilities and malicious code.
• Welcome Bar — a configurable banner at the top of your page, great for promotions or announcements.
• PACE — adds a loading progress bar to your pages.

Scrape Shield

Protects your content from bots, scrapers, and hotlinkers.

• Email Address Obfuscation — encodes email addresses on your pages so they're invisible to harvesting bots, but still readable to real visitors.
• Server-side Excludes — automatically hides sensitive content from suspicious visitors — scrapers, comment spambots, or anything making repetitive automated requests.
• Hotlink Protection — prevents other sites from embedding your images directly, saving your bandwidth.