Quick orientation before we go live

Here's the map for today — then we're 100% live in the dashboard

One network, sitting between your visitors and your origin. Every request passes through this same layered path, in this order, before it ever reaches your infrastructure. We'll walk each layer live — this is just the map first.

1DNS Onboarding 2TLS 3Caching & Performance 4WAF 5Bot Management 6DDoS Protection 7Rate Limiting
🌐
Visitor browser / API client
request / response
Cloudflare Network
1DDoSAlways-on, network layer
2TLSEncrypt / validate
3WAFBlock malicious requests
4Bot MgmtHuman vs automated
5Rate LimitPer-identity thresholds
6CacheServe without hitting origin
Only traffic that clears every layer — and isn't already cached — reaches your origin
only if not blocked / cached
🖥️
Your Origin web app / API
DNS Onboarding

Two ways onto Cloudflare

The difference is whether Cloudflare becomes your authoritative DNS provider — the system that holds the real, final answer for every query about your domain — or just proxies specific hostnames while someone else stays authoritative.

Most common

Full (Primary) Setup

  • Cloudflare becomes your authoritative DNS provider
  • Change nameservers at your registrar — one-time step
  • Manage all DNS records in Cloudflare going forward
  • DNS-layer DDoS protection included (Cloudflare sees all query traffic)
  • Available on every plan, including Free
Business/Enterprise only

CNAME (Partial) Setup

  • Keep your existing authoritative DNS provider
  • No nameserver change — add CNAME records instead
  • Only the specific hostnames you point get proxied
  • No DNS-layer DDoS protection — Cloudflare isn't authoritative
  • Apex domain needs CNAME flattening support from your provider
↑ Back to the map
TLS / SSL

Encryption modes — how far does it actually go?

"Encrypted" isn't one thing — these are four genuinely different postures between the edge and your origin.

OffNo encryption at all
FlexibleVisitor→Cloudflare encrypted, Cloudflare→Origin plaintext
FullEncrypted end-to-end, origin cert not validated
Full (strict)Encrypted end-to-end, origin cert cryptographically validated
↑ Back to the map