What the Cloudflare plugin does on your site
The Cloudflare plugin is published by Cloudflare itself under the open source BSD-3-Clause license. On its own it does nothing: it connects WordPress to a Cloudflare account whose domain already runs through the company’s network (Cloudflare nameservers), then lets you manage that domain from the dashboard. You sign in with your email address and an API token (or the Global API Key), and the plugin calls the Cloudflare API on your behalf.
Its headline feature is Automatic Platform Optimization (APO): Cloudflare caches your pages’ HTML on its CDN, not just images, CSS and JavaScript. The plugin sends a cf-edge-cache header on every page that allows or forbids caching (never for a logged-in user), and purges the affected URLs when you publish, edit or trash content or approve a comment. According to Cloudflare’s documentation, APO keeps pages for 30 days and invalidates them within 30 seconds of a change.
The rest fits into a handful of cards: one-click recommended settings for WordPress, cache purging (everything, or up to 30 files at a time), Always Online, Security Level, Development Mode and Automatic HTTPS Rewrites. The plugin also swaps Cloudflare’s IP address for the visitor’s (the CF-Connecting-IP header), which matters for comments and logs. The plugin is free; what costs money is Cloudflare’s plans and the APO add-on.
Which sites the Cloudflare plugin is the right choice for
- Sites whose domain is already on Cloudflare: you no longer need the Cloudflare dashboard to purge the cache or adjust everyday settings.
- Blogs and publishing sites with an international audience, which gain the most from serving pages from Cloudflare’s network with APO.
- Sites on modest hosting: with APO, most anonymous visits no longer hit the server.
It is pointless if you don’t want to hand your nameservers to Cloudflare, and APO does not support multisite installs. If you already run a page caching plugin such as WP Rocket, Cloudflare advises turning it off while you set up APO, then testing whether turning it back on helps. To get the real visitor IP and the firewall right, read our guide to running WordPress behind Cloudflare.
Cloudflare plugin strengths and limitations
Strengths
- HTML caching at the edge. With APO, public pages are served by Cloudflare without touching your server, and purged automatically whenever you publish.
- Official and free. Maintained by Cloudflare, open source, with no paid version of the plugin.
- Real visitor IPs. The address passed on by Cloudflare replaces the proxy’s, and version 4.14.5 checks that it is a valid IP address.
- Credentials outside the database. The
CLOUDFLARE_EMAILandCLOUDFLARE_API_KEYconstants inwp-config.phpkeep the key out of the options table.
Limitations
- Useless without Cloudflare. The domain must use Cloudflare nameservers and you need an account.
- APO costs extra on the Free plan. $5 per month, included only from the Pro plan up.
- Settings apply to the whole zone. On a subdomain, every setting except APO also applies to the main domain, as the plugin warns.
- English-only and partly dated interface. The Image Optimization card still describes Mirage, which Cloudflare retired on September 15, 2025; Polish requires a paid plan.
The Cloudflare plugin settings we recommend
The plugin lives under Settings > Cloudflare. Its interface is in English, so card names are given exactly as they appear. Any change made here alters the Cloudflare zone, and therefore the whole site.
| Setting | Recommended value | Why |
|---|---|---|
| Credentials Settings > Cloudflare, sign-in screen | API token created from the "WordPress" template | A token scoped to the zone exposes less than the Global API Key, which unlocks the whole account. |
| Apply Recommended Cloudflare Settings for WordPress Settings > Cloudflare > Home | "Apply" once, then review | Among other things, it sets Security Level to Medium, turns on Always Online, Automatic HTTPS Rewrites and email obfuscation, and leaves Rocket Loader off. |
| Automatic Platform Optimization Settings > Cloudflare > Home | On if you have APO | This is what caches the HTML; afterwards, clear the cache of any other caching plugin. |
| Cache By Device Type Automatic Platform Optimization card | Off, unless your theme serves different HTML on mobile | A responsive theme doesn’t need it, and changing it invalidates the entire cache. |
| Auto Purge Content On Update Settings > Cloudflare > Settings > Speed | Off with APO | The plugin itself states that APO supersedes this option. |
| Always Online Settings > Cloudflare > Settings > Speed | Depends on your site | During an outage it serves an archived copy, and to do so it shares your popular URLs with the Internet Archive. Turn it off if your pages must not be archived. |
| Security Level Settings > Cloudflare > Settings > Security | Default value; "Under Attack" only during an attack | That mode puts a challenge page in front of every visitor and can block API calls. |
| Development Mode Settings > Cloudflare > Settings > Speed | Off | It bypasses the whole cache for three hours; purge the affected files instead. |
| Automatic HTTPS Rewrites Settings > Cloudflare > Settings > Security | On | Fixes mixed content by switching resources to HTTPS where they support it. |
- Check the headers of a public page while logged out:
cf-cache-status: HITandcf-edge-cache: cache,platform=wordpressshow that APO is working. - Publish a change and reload the page: it should appear without a manual purge.
- Test the cart, the customer account and your forms in a private window.
- Turn on auto-updates for the plugin under Plugins.
Cloudflare plugin security and your API credentials
The most notable flaw is CVE-2024-0212, fixed in 4.12.3: a user with a basic account (Subscriber) could read Cloudflare API data through the cloudflare_proxy AJAX action. Version 4.14.5 added further hardening (constant-time CSRF token comparison, escaping on the settings page, validation of the CF-Connecting-IP header).
Keep the plugin up to date and use a scoped API token rather than the Global API Key: if it leaks, it only grants what it allows. On the network side, the WordPress-specific managed rulesets of the web application firewall (WAF) that the plugin promotes require a paid plan; the Free plan includes the Free Managed Ruleset. WP Masquerade Pro hides the plugin’s folder addresses, but the cf-ray and cf-cache-status headers, added by Cloudflare’s network, stay visible.
What WP Masquerade hides for Cloudflare
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Cloudflare: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
Nothing more
Still visible
- server or cache headers
cf-ray, cf-cache-status (Cloudflare network)
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Cloudflare plugin frequently asked questions
Do I need a Cloudflare account to use the plugin?
Yes. The first time you sign in, the plugin asks for the account email and an API token or the Global API Key, and the domain must already be active on Cloudflare.
Is APO free?
Not on the Free plan, where it is a $5 per month add-on. It is included in the Pro plan ($20 per month billed annually, or $25 billed monthly), Business and Enterprise.
Can I keep WP Rocket or another caching plugin with APO?
Cloudflare lists WP Rocket as compatible from version 3.8.6, but recommends turning caching plugins off while you set up APO, then checking whether turning them back on helps or causes problems. Clear their cache after enabling APO.
Why do I see cf-cache-status: BYPASS when APO is on?
Either you are logged in to WordPress, and APO never serves cached pages to logged-in users, or Chrome DevTools is sending Cache-Control: no-cache. Uncheck "Disable cache" or test in a private window.
Is the plugin worth it without APO?
Yes, though less so: real visitor IPs, cache purging and everyday settings from WordPress. Without APO, Cloudflare does not cache your pages’ HTML by default.