Cloudflare Settings for WordPress Cheat Sheet: SSL Modes, Caching, APO, WAF and 1xxx Codes

Cloudflare sits between your visitors and your WordPress server, so a single setting there can cause a redirect loop, a stale page, a blocked customer or a broken checkout, and none of it shows up in WordPress. This sheet lists the Cloudflare settings that matter most for WordPress: SSL/TLS modes, caching, APO, the security features, the 1xxx block codes and the response headers that tell you what Cloudflare did. Each row says what the setting does and how it tends to break WordPress.

Read this first: Cloudflare reorganizes its dashboard often. Labels and limits here come from Cloudflare’s documentation at the time of writing; if a label differs, use the dashboard search box. Settings only apply to DNS records that are proxied (orange cloud). A gray cloud record (DNS only) bypasses every feature on this page.

Placeholders

Placeholder	Replace with
example.com	Your domain
203.0.113.10	An IP address (yours, a visitor’s or your server’s, as the row says)
RAY_ID	The Ray ID printed at the bottom of a Cloudflare error page, or in the cf-ray response header

SSL/TLS encryption modes

Set under SSL/TLS > Overview. The mode controls the connection between Cloudflare and your server; visitors always see Cloudflare’s certificate.

Mode	Cloudflare to your server	WordPress notes
Automatic SSL/TLS	Cloudflare probes your server and picks the most secure mode that works; it will not lower the mode on its own	Being rolled out; zones not yet migrated only show the custom choices below
Off	Plain HTTP, and visitors get plain HTTP too	Do not use
Flexible	Plain HTTP to the server, even when the visitor uses HTTPS	Causes ERR_TOO_MANY_REDIRECTS when WordPress, the server or a plugin forces HTTPS, because the server only ever sees HTTP. Avoid.
Full	HTTPS (matching the visitor’s protocol), certificate not validated	Works with self-signed or expired origin certificates. Better than Flexible, weaker than strict.
Full (strict)	HTTPS with the origin certificate validated (public CA such as Let’s Encrypt, or Cloudflare Origin CA)	Recommended by Cloudflare. An expired or wrong origin certificate gives error 526; see AutoSSL and Let’s Encrypt not issuing.
Strict (SSL-Only Origin Pull)	Always HTTPS with validation, even if the visitor used HTTP	Useful when the server only listens on 443

Related certificate settings

Setting	What it does	WordPress notes
Always Use HTTPS	Redirects every HTTP request to HTTPS at Cloudflare	Cloudflare recommends not also redirecting at the origin, to avoid loops. Pick one place for the redirect; see one-hop redirects.
Automatic HTTPS Rewrites	Rewrites http:// links to https:// where the resource supports HTTPS	Hides mixed content rather than fixing it; fix the URLs in WordPress too. See mixed content.
HSTS	Tells browsers to use only HTTPS for a period	Hard to undo. Only enable once HTTPS works on every subdomain; see HSTS errors.
Origin Server (Origin CA certificates)	Free certificates for your server trusted only by Cloudflare	Good with Full (strict) when the site stays proxied. Browsers do not trust them if you later switch the proxy off.

Caching

What Cloudflare caches by default

Behavior	Detail from Cloudflare’s documentation
HTML and JSON	Not cached by default. Pages come from your server unless a Cache Rule or APO says otherwise.
Static files	Cached by file extension (not MIME type): CSS, JS, images, fonts, PDFs, archives, media and more. robots.txt is cached too.
Not cached	Responses with Cache-Control: private, no-store, no-cache or max-age=0, responses with Set-Cookie, and any method other than GET
Default edge time without cache headers	200, 206 and 301: 120 minutes. 302 and 303: 20 minutes. 404 and 410: 3 minutes
Development Mode	Bypasses the cache (and Polish) for three hours, then switches itself off. It does not purge anything.

Cache Rules for WordPress

Create under Caching > Cache Rules. Cloudflare documents 10 Cache Rules on Free, 25 on Pro, 50 on Business. Cloudflare recommends Cache Rules over the older Page Rules for cache control (Page Rules allow only 3 on Free).

Goal	Rule	Why
Never cache admin and login	Bypass cache when the path starts with /wp-admin or equals /wp-login.php	Admin pages are personal
Never cache for logged-in users	Bypass cache when the cookie contains wordpress_logged_in_ or wp-postpass_	Otherwise visitors can be served an admin bar or a password-protected page
Never cache store pages	Bypass cache for /cart/, /checkout/, /my-account/ and when cookies contain woocommerce_items_in_cart or wp_woocommerce_session_	Cached carts and checkout nonces break orders; see cart and session problems
Cache HTML for everyone else	“Eligible for cache” on other pages, with an edge TTL you choose	Speeds up anonymous traffic. Only add this after the bypass rules above, and purge after every content change.

Careful: a rule that caches everything with no bypasses is the classic cause of logged-in pages, carts and form nonces being served to the wrong people. See our guide on changes not showing and visitors seeing an old version for purging the right cache.

APO (Automatic Platform Optimization)

Point	Detail
What it does	Caches your WordPress HTML at Cloudflare’s edge and purges it when you update content
Requirement	The Cloudflare WordPress plugin must be installed and connected. Cloudflare documents that the plugin does not support multisite.
What it skips	Requests with bypass cookies (logged in, session and WooCommerce cookies), excluded paths such as checkout, wp-cron.php and feeds, and most query strings other than common marketing parameters
How to see what it did	cf-cache-status shows HIT or DYNAMIC, and the cf-apo-via header gives the reason when it bypassed
Common problem	Another page cache plugin serving stale pages without the header APO needs. Purge that plugin’s cache and APO together. Do not stack APO with a Cache Everything rule unless you know why.
Price	Check Cloudflare’s current plan pages; not listed here

Speed settings that commonly break WordPress

Setting	What it does	What breaks	Test
Rocket Loader	Defers all JavaScript until after the page renders	Menus, sliders, forms, page builder effects, consent banners, inline scripts that expect jQuery. Cloudflare’s own advice for JavaScript or jQuery issues is to disable it and retest.	Switch it off, purge, retest. See scripts broken after delay JS.
Email Address Obfuscation	Replaces email addresses in HTML and injects a decode script (email-decode.min.js)	Email addresses inside scripts, JSON, forms or builder attributes can show as [email protected] or break the markup	Switch it off for the page, or use a configuration rule
Caching HTML (Cache Rules, APO)	Serves pages from the edge	Nonces expire in cached pages: “The link you followed has expired”, form and AJAX failures	See the link you followed has expired

Security features

Feature	Where	What to know for WordPress
Security Events	Security > Analytics, Events tab	Every block or challenge, filterable by Ray ID, IP, path, country and service. Free plan shows sampled logs; data goes back up to 31 days. Start every investigation here.
WAF custom rules	Security > Security rules	Your own match expressions with Block, Managed Challenge, Skip and other actions. Blocks show the WAF block page (“Sorry, you have been blocked”), not error 1020.
Skip action	A custom rule with action Skip	Lets matching requests bypass chosen features (rate limiting, managed rules, Super Bot Fight Mode and others). Cannot skip Bot Fight Mode.
WAF managed rules	Security rules, managed rules	Cloudflare’s attack signatures. False positives on page builder saves and big forms: add an exception for the rule on that path, do not disable the ruleset.
Rate limiting rules	Security rules	Returns error 1015 when exceeded. Too tight a window catches whole offices behind one IP. Cloudflare suggests trying 10 seconds instead of 1 second if a rule blocks too quickly.
IP Access rules	WAF tools	Allow, block or challenge by IP, ASN or country (country blocks are Enterprise only here). An Allow bypasses custom rules, rate limiting and managed rules for that address. Allowed requests do not show in Security Events.
Bot Fight Mode (free)	Security > Settings, filter Bot traffic	Challenges traffic that looks like known bots. Cannot be skipped by custom rules or Page Rules; an IP Access rule that matches first stops it. Turn off if it challenges tools you rely on.
Super Bot Fight Mode (paid)	Security > Settings, filter Bot traffic	Supports skip rules, and has an Optimize for WordPress option that lets your site’s own loopback requests through
Browser Integrity Check	Security > Settings	On by default. Blocks requests with missing or abnormal browser headers (error 1010). Can block scripts, apps and monitors.
Under Attack mode	Quick actions on the domain overview	Interstitial challenge for every visitor. A last resort: it affects analytics and can block WordPress loopback requests. Remember to switch it off.
Challenge Passage	Security settings	How long a solved challenge lasts (cf_clearance cookie). Default 30 minutes; Cloudflare recommends 15 to 45.

For a step by step fix when real people are blocked, see Cloudflare “Sorry, you have been blocked” and 1xxx errors.

1xxx error codes (visitor is blocked or misrouted)

Code	HTTP status	Meaning	Site owner’s fix
1005	403	Visitor’s network (ASN) banned	Check IP Access rules for the ASN
1006, 1007, 1008, 1106	403	Visitor’s IP address banned	Find the IP in IP Access rules or custom rules
1009	403	Visitor’s country or region banned	Check country rules
1010	403	Banned based on the browser’s signature	Browser Integrity Check: turn off or skip for that path
1012	403	Access denied due to malicious activity from the visitor’s computer or network	Usually the visitor’s side; Cloudflare suggests a malware scan
1015	429	Rate limited	Review the rate limiting rule threshold
1020	403	Access denied by a security feature with a Block action and no custom response	Search Security Events for the Ray ID or IP
1000, 1002	403	DNS points to a prohibited IP (for example another Cloudflare address)	Fix the A record to your server’s real IP
1001	409	DNS resolution error	Check the record exists and the zone is active
1016	530	Origin DNS error: Cloudflare cannot resolve the origin hostname	Fix the CNAME or A record target

Cloudflare notes that 1xxx codes appear in the HTML body of the error page, while the HTTP status line carries the 403, 409, 429 or 530 shown above. For 520 to 526, where Cloudflare cannot get a good answer from your server, see Cloudflare 52x errors.

Response headers that tell you what Cloudflare did

Header	Values	Meaning
server	cloudflare	The response came through Cloudflare
cf-ray	An ID ending in a location code	The Ray ID to search in Security Events and to quote to Cloudflare support
cf-cache-status	HIT	Served from Cloudflare’s cache
	MISS	Cacheable, but fetched from your server this time
	DYNAMIC	Not eligible for caching (normal for HTML without a Cache Rule or APO)
	BYPASS	Eligible, but your server’s response said not to cache (for example Set-Cookie or no-store)
	EXPIRED, REVALIDATED, UPDATING, STALE	Cached copy was out of date and was refreshed, confirmed unchanged, refreshed in the background, or served because your server could not be reached
age	Seconds	How long the cached copy has been in Cloudflare’s cache
cf-apo-via	For example origin,page-rules	Why APO bypassed the cache

Read them from your computer

curl -sI https://example.com/ | grep -iE "^(server|cf-ray|cf-cache-status|age|cf-apo-via):"

Where: your own computer (Windows: curl.exe in PowerShell, and use findstr /i "cf-" instead of grep). -s hides progress, -I fetches headers only, and grep -iE keeps the lines that matter. Run it twice: a page that shows MISS then HIT is caching. Our headers tool shows the same from outside your network.

curl -sI --resolve example.com:443:203.0.113.10 https://example.com/

What it does: sends the request straight to your server at 203.0.113.10, skipping Cloudflare, while still asking for example.com. Replace the IP with your server’s real address from your hosting panel. If this works and the normal request fails, the problem is in Cloudflare. If both fail, it is on the server.

Other settings worth knowing

Setting or fact	Detail	Why it matters
Maximum upload size	Cloudflare documents 100 MB on Free and Pro, 200 MB on Business	Big uploads, imports and backup restores fail behind the proxy; upload by SFTP or with the proxy off
Visitor IP at your server	Your server sees Cloudflare’s IPs; the real visitor IP is in the CF-Connecting-IP header	Configure mod_remoteip (Apache) or the realip module (Nginx) as Cloudflare documents, or login limiters, fail2ban and logs see Cloudflare instead of visitors
Gray cloud for mail	MX targets and mail hostnames must be DNS only	Cloudflare does not proxy mail; see moving DNS to Cloudflare without breaking email
Purge	Caching > Configuration: purge by URL, or purge everything	Purge after CSS or JS changes if file names do not change
Audit log	Account audit log	Shows who changed a rule and when, useful after a surprise block

See also

• Cloudflare “Sorry, you have been blocked”, 1020, 1015, 1010
• Cloudflare 520 to 526
• Move DNS to Cloudflare without breaking email
• ERR_TOO_MANY_REDIRECTS
• Traffic flood or DDoS
• HTTP status codes cheat sheet