Quick orientation before we go live

Here's the map for today — then we're 100% live in the dashboard

One network instead of five vendors. Nothing reaches your infrastructure until it's actually safe to.

We just looked at where that network actually lives, physically, all over the world. Now let's get specific about what happens at each of those points — DNS, encryption, caching, and security, one at a time.

DNS Onboarding

Two ways onto Cloudflare

The difference is whether Cloudflare becomes your authoritative DNS provider — the system that holds the real, final answer for every query about your domain — or just proxies specific hostnames while someone else stays authoritative.

Most common

Full (Primary) Setup

  • Cloudflare becomes your authoritative DNS provider
  • Change nameservers at your registrar — one-time step
  • Manage all DNS records in Cloudflare going forward
  • DNS-layer DDoS protection included (Cloudflare sees all query traffic)
  • Available on every plan, including Free
Business/Enterprise only

CNAME (Partial) Setup

  • Keep your existing authoritative DNS provider
  • No nameserver change — add CNAME records instead
  • Only the specific hostnames you point get proxied
  • No DNS-layer DDoS protection — Cloudflare isn't authoritative
  • Apex domain needs CNAME flattening support from your provider
💡 Most customers go Full Setup: full protection, one place to manage DNS, zero ongoing coordination with a second provider.
↑ Back to the map
TLS / SSL

Encryption modes — how far does it actually go?

"Encrypted" isn't one thing — these are four genuinely different postures between the edge and your origin.

OffNo encryption at all
FlexibleVisitor→Cloudflare encrypted, Cloudflare→Origin plaintext
FullEncrypted end-to-end, origin cert not validated
Full (strict)Encrypted end-to-end, origin cert cryptographically validated
💡 "Encrypted" alone isn't a compliance answer. Full (strict) is the difference between encrypted and actually verified end-to-end — the posture auditors and regulated data actually require.
↑ Back to the map
Caching & Performance

The fastest response is the one that never reaches your origin

Every cache hit is a request your origin never has to think about — that's latency and infrastructure load, at the same time.

Cache MISS
Visitor
→
Cloudflare
→
Origin (full round trip)
First request, or content not cacheable
Cache HIT
Visitor
→
Cloudflare
→
Served straight from the edge — origin never touched
💡 Page speed is a revenue conversation, not just a technical one — faster loads measurably reduce bounce rate and improve conversion.
↑ Back to the map
WAF

Two rule types, one enforcement point

Malicious requests are stopped before they ever reach your application code.

💉SQL InjectionMalicious DB query payloads in input fields
🧩Cross-Site ScriptingInjected scripts targeting other visitors
⚙️Remote Code ExecutionAttempts to run arbitrary code on your server
Managed RulesCloudflare-maintained, covers known CVEs and OWASP Top 10 patterns — updated continuously, no effort from you
Custom RulesYour own logic — specific paths, headers, or business rules unique to your application
💡 The real question isn't "can we block this" — it's the cost of one breach or one hour of downtime versus the cost of the control that prevents it.
↑ Back to the map
Bot Management

A score, not a switch

Every request gets scored 1-99. The action taken depends on where it lands — not a binary allow/block.

1Block
Definite bot
2-29Challenge
Likely bot — not blocked outright
30-99Allow
Likely human
💡 The gray zone gets challenged, not blocked — so you're not losing real customers to false positives while still shutting the door on automated abuse.
↑ Back to the map
DDoS Protection

Always-on, before anyone decides to turn it on

Every packet is inspected at the network layer by default — this isn't something you opt into during an attack.

🌊
Attack TrafficVolumetric / protocol / application layer
Cloudflare NetworkAbsorbed & filtered at the edge, globally distributed
✅
Your OriginNever sees the attack traffic at all
🎛️ Under Attack Mode — a manual dial for the application layer during an active incident: adds an extra interstitial check for every visitor. Not the first line of defense — the always-on network layer is.
💡 Uptime matters most during the exact moment it's hardest to guarantee — an active attack, not a normal Tuesday. That's precisely when this stays passive and automatic.
↑ Back to the map
Rate Limiting

Counting by the wrong thing lets attackers walk right through

If a compromised credential is used to pull data, does your current limiting even notice?

The gap

IP-Based Limiting

  • Counts requests per source IP address
  • An attacker spreading requests across a botnet of IPs never trips the limit
  • The credential itself is never the thing being tracked
The fix

Per-Identity Limiting

  • Counts by token, session, or JWT claim — the actual credential
  • Catches abuse regardless of how many IPs are used
  • Same stolen-credential scenario gets caught immediately
↑ Back to the map