CloudFlare CDN Setup

Setting up Cloudflare CDN

Cloudflare is the most widespread CDN with free plan including DDoS protection, WAF, SSL, and 300+ PoP network. Switching DNS to Cloudflare takes 15 minutes; caching setup takes another hour.

Setup

1. Register on cloudflare.com, add domain
2. Cloudflare scans DNS records and offers to import them
3. Replace NS servers at registrar with Cloudflare NS (kate.ns.cloudflare.com, jay.ns.cloudflare.com)
4. DNS propagation: 5 minutes – 24 hours

Orange cloud icon (proxied)—traffic goes through Cloudflare. Gray cloud (DNS only)—Cloudflare only resolves DNS.

SSL/TLS mode

Settings: SSL/TLS → Overview:

Caching rules (Cache Rules)

# Cloudflare Dashboard → Caching → Cache Rules

# Rule 1: Cache static assets
Condition: URI Path matches wildcard /assets/*
Action: Cache Everything, Edge TTL: 1 year, Browser TTL: 1 year

# Rule 2: Don't cache admin panel
Condition: URI Path matches wildcard /admin/*
Action: Bypass Cache

# Rule 3: Don't cache authenticated users
Condition: Cookie "laravel_session" exists
Action: Bypass Cache

# Rule 4: Cache public pages
Condition: URI Path matches regex ^/(|catalog|products|blog).*
Action: Cache Everything, Edge TTL: 5 minutes

Page Rules (legacy interface, still works)

example.ru/admin/*    → Cache Level: Bypass
example.ru/api/*      → Cache Level: Bypass
example.ru/assets/*   → Cache Level: Cache Everything, Edge Cache TTL: 1 year

Workers — edge computing

// Add security headers at CDN level
addEventListener('fetch', event => {
    event.respondWith(addSecurityHeaders(event.request));
});

async function addSecurityHeaders(request) {
    const response = await fetch(request);
    const newResponse = new Response(response.body, response);

    newResponse.headers.set('X-Frame-Options', 'SAMEORIGIN');
    newResponse.headers.set('X-Content-Type-Options', 'nosniff');
    newResponse.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
    newResponse.headers.set('Permissions-Policy', 'camera=(), microphone=()');

    return newResponse;
}

Speed optimizations

• Auto Minify → HTML, CSS, JS (enable)
• Rocket Loader → async JS loading (test—may break some scripts)
• Polish → auto image conversion to WebP (paid plans only)
• Mirage → responsive images (paid)
• Early Hints → 103 Early Hints for preloading (enable)

Firewall Rules / WAF

# Block bots by User-Agent
(http.user_agent contains "sqlmap") or
(http.user_agent contains "nikto") or
(http.user_agent eq "") → Block

# Challenge for suspicious countries
(ip.geoip.country in {"CN" "RU" "KP"} and not cf.bot_management.verified_bot)
→ Managed Challenge

# Rate Limiting for API
/api/* → 100 requests per 60 seconds from one IP

Terraform for Infrastructure as Code

resource "cloudflare_zone_settings_override" "example" {
    zone_id = var.zone_id
    settings {
        ssl            = "strict"
        always_use_https = "on"
        min_tls_version  = "1.2"
        http3            = "on"
        brotli           = "on"
        early_hints      = "on"
        cache_level      = "aggressive"
    }
}

resource "cloudflare_page_rule" "cache_assets" {
    zone_id  = var.zone_id
    target   = "${var.domain}/assets/*"
    priority = 1
    actions {
        cache_level       = "cache_everything"
        edge_cache_ttl    = 31536000
        browser_cache_ttl = 31536000
    }
}

Setup time: several hours for basic config with caching and WAF.