I installed the free version of Cloudflare on this blog in order to understand the setup involved. The advertised benefits of Cloudflare are:
- Security, e.g. mitigating denial-of-service attacks, identifying bots and limiting scrapers. These measures reduce workload on your own infrastructure and protect your content.
- Performance, including an easy-to-use (and often automatic) content delivery network (CDN) to serve files quickly from diverse geographical locations closer to each user;
- Reliability, by increasing redundancy in responding to DNS queries and routing traffic efficiently on distributed infrastructure.
I don’t have any problems with bots or scalability on this blog (I can dream) but a little extra performance
never rarely hurts. Mostly it’s a learning experience ahead of getting Cloudflare up and running on more important websites.
If my past CDN experience is anything to go by, re-routing all traffic always comes with a few challenges but, for a simple WordPress site like this one, the setup was simple. The main step was to point the domain nameservers to Cloudflare instead of my original DNS provider. It felt incredibly simple.
The remaining quirks were around user IP addresses and cache invalidation.
Ensuring that WordPress sees the end user’s IP address
Since HTTP(S) requests from users’ browsers go to Cloudflare, and Cloudflare makes corresponding (less frequent) requests to my server, WordPress would see Cloudflare’s IP addresses every time instead of the IP addresses of individual end users.
This matters, for example, because WordPress saves the IP address of a user when they add a comment, and Akismet relies upon it to help identify spam.
Cloudflare helpfully passes the original user’s IP address in an HTTP request header, but I needed a way to tell WordPress to look for that header. There are two Apache modules which help:
- mod_cloudflare is mentioned in some old Cloudflare documentation, but it’s no longer supported;
- mod_remoteip is recommended now although it isn’t Cloudflare-specific and requires some configuration.
However, instead of solving the problem at that low level, I realised there was a Cloudflare plugin for WordPress itself. Not only did it solve the IP address issue, but it also met my another requirement…
Clearing the CDN cache when something changes
You can do this manually in Cloudflare’s website, which would probably be okay for a site this small. Alternatively, you can send an API request with the same instruction. Best of all, the process can be automated fully by the Cloudflare WordPress plugin above, which gave it the edge over the Apache modules.