What Is a CDN and How Does It Work?

A CDN (Content Delivery Network) is a distribution network that copies your website's images, CSS, JavaScript, and even HTML files to servers located around the world. When a visitor opens your site, the files aren't served from your origin server (say, hosting in Istanbul) but from the CDN node closest to that visitor (the edge server).

Here's an example: your server is in Turkey. Without a CDN, a visitor in Germany connects to a server roughly 2,500 km away on every single request. With a CDN like Cloudflare, that same visitor instead connects to an edge server in Frankfurt — the distance drops to a few dozen kilometers, and latency falls from around 150 ms to 20 ms.

A CDN's core mechanism works in three steps:

  1. First request: A visitor requests a page; if the CDN node doesn't have the file yet, it pulls it from the origin server and caches it.
  2. Subsequent requests: Other visitors in the same region are served the file straight from the CDN node, without the origin server being touched at all.
  3. When the TTL expires: Once the cache duration (TTL) runs out, the CDN re-fetches the file from the origin and refreshes it.
💡 Good to know: A CDN isn't just a "speed booster." By hiding your origin server's IP address, it also shields it from direct attacks — visitors only ever see the CDN's IP.

Why Should You Use a CDN?

Here's what a CDN concretely does for your site:

  • ⚡ Speed: Static files (images, CSS, JS) are served from the point closest to the visitor. TTFB (time to first byte) drops significantly.
  • 📉 Lower server load: With 60-80% of traffic served straight from the CDN, your origin server gets to breathe — the same hosting plan can handle far more visitors.
  • 🛡️ DDoS protection: Attack traffic is filtered at the CDN layer, blocked before it ever reaches your origin server.
  • 🌐 Global reach: If you have visitors from abroad, page load times improve dramatically.
  • 💰 Bandwidth savings: Less traffic leaves your hosting account, so you run into bandwidth limits far less often.

This effect is especially noticeable on image-heavy sites and WordPress installs. Your server's disk speed also plays a role in overall performance — take a look at our NVMe vs SSD hosting comparison article to see the difference. When choosing your hosting infrastructure, check the speed and uptime scores on our hosting comparison page.

✅ Real-world example: An image-heavy e-commerce site hosted in Turkey cut its measured LCP from roughly 3.1s to about 1.4s after turning on Cloudflare caching. Requests reaching the origin server dropped by around 70%.

Why Cloudflare?

There are plenty of CDNs on the market (Cloudflare, Fastly, BunnyCDN, Amazon CloudFront). For beginners and small businesses, though, Cloudflare is the most sensible starting point. The reason: even its free plan is more than enough.

Feature Cloudflare Free Cloudflare Pro (~$20/month / ~₺650-800)
Global CDN ✅ Yes (330+ cities) ✅ Yes
Free SSL ✅ Yes ✅ Yes
DDoS protection ✅ Unlimited (L3/L4/L7) ✅ Advanced rules
WAF (Web Application Firewall) Limited (5 rules) ✅ Fully managed
Image optimization (Polish) ❌ Not included ✅ Included (WebP conversion)

For small/medium blogs, corporate sites, and most e-commerce stores, the free plan is enough. The need for Pro usually comes up when you want advanced WAF rules and image optimization.

Setting Up Cloudflare (Step by Step)

Setting up Cloudflare comes down to changing your domain's nameserver (NS) records — in other words, you hand your domain's DNS management over to Cloudflare. Here's the full process:

  1. Create an account: Sign up for free at cloudflare.com and verify your email.
  2. Add your site: Click "Add a Site" and enter your domain (e.g. yoursite.com). Choose the "Free" plan.
  3. DNS scan: Cloudflare automatically scans your existing DNS records. Make sure to check that your A, CNAME, and MX records were imported completely — especially your email (MX) records.
  4. The orange cloud (proxy): For A and CNAME records, the cloud icon should be orange (proxy on = CDN + protection active). Leave email records and anything needing a direct connection set to grey (DNS only).
  5. Change your nameservers: Cloudflare gives you two NS addresses (e.g. dana.ns.cloudflare.com). Enter these in your domain registrar's panel in place of your current nameservers.
  6. Wait for propagation: NS changes typically propagate within 15 minutes to a few hours (rarely up to 24 hours). Cloudflare emails you once it's active.
⚠️ Careful: Before changing your NS records, make sure every existing DNS record (A, MX, TXT, SPF/DKIM) has been correctly imported into Cloudflare. A missing MX record will break your email. To brush up on the fundamentals, read our DNS management guide.

To verify the setup, you can check your nameservers from a terminal with this command:

# Query the domain's nameserver records
dig NS yoursite.com +short

# Expected output (Cloudflare's nameservers):
# dana.ns.cloudflare.com.
# rob.ns.cloudflare.com.

# Confirm the site is passing through Cloudflare (server: cloudflare)
curl -sI https://yoursite.com | grep -i "server\|cf-cache-status"

SSL and HTTPS Settings

Once Cloudflare is active, a free SSL certificate is issued automatically. That said, the SSL mode setting is critical. Under SSL/TLS → Overview, pick the right mode:

  • Flexible: HTTPS between Cloudflare and the visitor, but HTTP between Cloudflare and your server. Not recommended — it can cause a redirect loop and creates a security gap.
  • Full: HTTPS on both legs, but the server's certificate isn't validated. An acceptable minimum.
  • Full (Strict): ✅ Recommended. Choose this if your server has a valid SSL certificate (e.g. Let's Encrypt) — it's the most secure option.

If your server doesn't have SSL yet, you can install free Let's Encrypt through cPanel and then switch to Full (Strict). See our free SSL certificate guide for details. Also turn on "Always Use HTTPS" to redirect all HTTP traffic to HTTPS.

💡 Tip: If you pick Full (Strict) without a valid certificate on your server, the site will throw a "526 Invalid SSL certificate" error. Set up SSL on the server first, then switch to Strict.

Caching Rules

To get the full benefit of a CDN, you need a caching strategy. By default, Cloudflare only caches static files (images, CSS, JS) — not HTML. On dynamic sites like WordPress, intelligently caching HTML too makes a huge difference.

Baseline settings (Caching → Configuration):

  • Caching Level: Leave it on "Standard" (ideal for most sites).
  • Browser Cache TTL: "4 hours" or longer for static assets.
  • Always Online: Turn this on — even if your server goes down, Cloudflare serves an archived page from cache.

Caching HTML with Cache Rules (use carefully): Caching HTML only works for pages seen by logged-out (visitor) traffic — that's what actually boosts performance. On WordPress, always exclude cart/account/wp-admin pages. Here's example rule logic:

# Cache Rules → new rule example (expression logic)
# Exclude WordPress admin and dynamic paths from caching

(http.request.uri.path contains "/wp-admin")
  or (http.request.uri.path contains "/cart")
  or (http.request.uri.path contains "/checkout")
  or (http.cookie contains "wordpress_logged_in")

# Action: Bypass cache (never cache these requests)

After updating a page, clear the cache via Caching → Configuration → Purge Cache so visitors don't keep seeing the old version. Purging individual URLs ("Custom Purge") is the safest approach; "Purge Everything" drops the whole site into a cold cache.

DDoS Protection and Security

Cloudflare's most valuable feature — even on the free plan — is unlimited DDoS protection. Network and transport layer (L3/L4) attacks are filtered automatically. Against application-layer (L7) attacks, though, you'll need to manually strengthen a few settings:

  • Security Level: Normally "Medium." During an attack, switch to "High" or "I'm Under Attack!" mode — this shows every visitor a 5-second JS challenge screen and filters out bots.
  • Bot Fight Mode: Turn it on; it automatically blocks known bad bots (available even on the free plan).
  • Rate Limiting: Caps how many requests a given IP can make per minute (e.g. brute-force attempts against a login page).
  • WAF rules: The free plan gives you 5 custom rules. Use them to block SQL injection attempts or specific countries.

A CDN is only one layer of security. Don't skip server-side precautions either — for a full checklist, see our 10 hosting security measures article. For high-traffic or attack-prone projects, weigh stronger infrastructure options on our VDS comparison page.

⚠️ Critical: Cloudflare hides your origin IP, but if an attacker has already learned it from old DNS records or email headers, they can attack your server directly. Change your origin IP and configure your server firewall to only allow traffic from Cloudflare's IP ranges.

Common Mistakes

The most frequent Cloudflare setup problems and how to fix them:

  • Redirect loop (ERR_TOO_MANY_REDIRECTS): Usually caused by "Flexible" SSL mode clashing with a forced HTTPS redirect on the server. Switch the SSL mode to "Full (Strict)."
  • Email stops working: The MX record got proxied (orange cloud). Set MX records and mail subdomains to grey (DNS only).
  • Changes aren't showing up: Aggressive HTML caching. Run "Purge Cache" for the affected URL, or temporarily turn on Development Mode.
  • Real visitor IPs missing from logs: Server logs show Cloudflare's IP instead. Configure your server to read the CF-Connecting-IP header (mod_cloudflare / mod_remoteip).

Frequently Asked Questions

Is Cloudflare really free?

Yes. Cloudflare's free plan — including the CDN, unlimited DDoS protection, and free SSL — is more than enough for most sites. The Pro plan (roughly $20/month, or about ₺650-800) is only needed for extras like advanced WAF rules and image optimization.

Will a CDN actually make my site faster?

The difference is very noticeable if you have visitors from abroad or a site heavy on images and static files. Static files are served from the point closest to the visitor, and TTFB drops. For a fully dynamic API that can't be cached, the impact is more limited.

Do I need to switch hosting providers to set up Cloudflare?

No. Cloudflare only manages the DNS and traffic layer; your existing hosting server stays exactly as the origin. You simply point your domain's nameservers at Cloudflare. You can turn on the CDN without switching hosting providers.

How long does a nameserver change take?

Usually somewhere between 15 minutes and a few hours. In rare cases, full global propagation can take up to 24 hours. Your site keeps running without interruption the whole time — the CDN just phases in gradually.

Can I remove SSL from my server once I'm using Cloudflare?

Don't. Full (Strict) — the most secure mode — requires a valid SSL certificate on your server (free Let's Encrypt is enough). If you remove the server certificate, you'll either have to weaken your security or run into a "526" error.