Best Cloudflare Free Plan Settings for a Small Business Site

Cloudflare's free plan gives a small business site a CDN, free edge certificates, DDoS protection and a basic web application firewall, but most of the value depends on a handful of settings that many sites never touch. This guide walks through the best Cloudflare free plan settings in the order you should check them: encryption, HTTPS, TLS, compression, caching, bots, the WAF and DNS. Every setting below was checked against Cloudflare's current documentation in October 2026, and we flag the ones that can break things if you rush them.

Before you change anything

Cloudflare sits between your visitors and your hosting, so a wrong setting can take a site offline or break email. Confirm the zone shows as Active, screenshot your current settings, and make sure your host has a valid SSL certificate: most of the settings below assume it does. If you're still deciding whether you need Cloudflare at all, see whether you need a CDN.

SSL/TLS encryption mode: use Full (strict)

The encryption mode controls two connections: visitor to Cloudflare, and Cloudflare to your server. You'll find it on the SSL/TLS > Overview page.

Full (strict) is the setting to aim for. Cloudflare's docs list four requirements for it: the origin certificate must be in date, issued by a publicly trusted CA or by Cloudflare's own Origin CA, match the requested hostname, and the origin must accept HTTPS on port 443. If any of those fail, visitors see a 526 error.

Newer zones may show Automatic SSL/TLS, which scans your origin roughly monthly and moves you to the most secure mode it supports, never downgrading. If your origin has a valid certificate, choosing Full (strict) yourself gets you there immediately.

Flexible mode is the most common cause of redirect loops. If your host or WordPress redirects HTTP to HTTPS and Cloudflare connects to it over HTTP, the two bounce visitors back and forth forever. The fix is a real certificate on the origin (most hosts include free Let's Encrypt, or you can install a free Cloudflare Origin CA certificate) and Full (strict).

Always Use HTTPS and HSTS

Always Use HTTPS

Go to SSL/TLS > Edge Certificates and turn on Always Use HTTPS. It redirects every HTTP request to HTTPS across the zone and is available on the free plan. Two points from Cloudflare's docs:

• Cloudflare recommends not also doing HTTPS redirects at your origin, because that can cause loops.
• If only part of your site supports HTTPS, don't enable it zone-wide. Use a single redirect rule instead.

It won't fix mixed content errors.

HSTS

HSTS tells browsers to skip HTTP entirely for your domain. In Cloudflare it lives under SSL/TLS > Edge Certificates > HTTP Strict Transport Security (HSTS). You'll set:

• Max Age: start low (one month) and raise it to 12 months once you're confident.
• Apply HSTS policy to subdomains: only if every subdomain works over HTTPS.
• Preload: needs a 12-month max age and a separate submission to the preload list. Leave it off unless you understand the commitment.
• No-Sniff Header: sends X-Content-Type-Options: nosniff. Turn this on; it is safe for almost every site.

Once HSTS is on, don't switch records to DNS-only, pause Cloudflare or move nameservers unless your origin serves valid HTTPS itself. Cloudflare's docs warn this can make the site inaccessible until HTTPS is restored. Our HSTS guide explains how to roll it out safely.

Minimum TLS version and TLS 1.3

Under SSL/TLS > Edge Certificates, set Minimum TLS Version. Cloudflare's default is TLS 1.0, which is very permissive. Cloudflare's own reference says TLS 1.2 is the version required by the PCI Security Standards Council and recommends TLS 1.2 for business and productivity apps.

For a typical small business site, set the minimum to TLS 1.2. Every current browser supports it, and it removes the outdated protocols. Make sure TLS 1.3 is switched on on the same page so modern browsers get the faster handshake. Setting the minimum to 1.3 is possible but can lock out some older devices and business systems, so test before you go that far. Our post on TLS 1.3 explains the differences.

Compression: Brotli, Zstandard and gzip

Older guides point you to a Brotli toggle. There is no longer a Brotli switch to set. Cloudflare compresses text responses automatically; its current docs say free plan content is compressed by default with Zstandard (Pro and Business use Brotli), depending on what the visitor's browser accepts. Just make sure your origin isn't sending Cache-Control: no-transform, which opts responses out. See gzip vs Brotli compression for how the algorithms compare.

Caching level, browser cache and what Cloudflare caches by default

What is cached out of the box

Cloudflare's docs are clear that its CDN does not cache HTML or JSON by default. It caches static files by extension: images, CSS, JavaScript, fonts, PDFs and similar. That's a safe default, because HTML often contains cart contents, logged-in admin bars or form tokens.

It also respects your origin's headers: responses with private, no-store, no-cache, max-age=0 or a Set-Cookie header aren't cached.

Caching level

Under Caching > Configuration > Caching level, leave it on Standard (the default), which caches a separate copy for each query string. Ignore Query String serves one cached file whatever the query string, which can serve the wrong version of a file if your theme versions assets with ?ver=.

Browser Cache TTL

On the same page, Browser Cache TTL can be left at Respect Existing Headers if your host already sends sensible Cache-Control headers. If it doesn't, setting a value here overrides them. Our guide to browser caching and Cache-Control explains what good values look like.

Cache rules on the free plan

Free accounts can create 10 cache rules under Caching > Cache Rules. Useful ones for a small business site:

1. Bypass cache for admin and checkout paths. For WordPress, match URI paths starting with /wp-admin or /wp-login.php; for WooCommerce, add /cart, /checkout and /my-account. Set cache eligibility to Bypass cache.
2. Longer edge TTL for static assets. Match file extensions such as css, js, woff2, webp, avif and set an edge TTL of a month, if your filenames change when you update them.
3. Cache HTML only if your site is genuinely static. For a brochure site with no logins or forms that vary per user, a rule marking HTML as eligible for cache can cut server load and time to first byte. Never cache HTML on a shop or membership site without bypass rules for logged-in users.

Purge the cache after changes and test in a private window.

Bot Fight Mode: useful, with one big caveat

Bot Fight Mode is the free plan's bot protection. Cloudflare describes it as flagging traffic that matches known bot patterns and issuing computationally expensive challenges. Enable it from the Security Settings page, filtered by Bot traffic.

Before you switch it on, know the limits Cloudflare documents:

• It can't be bypassed with WAF rules or Page Rules. Skip, Bypass and Allow actions have no effect on it. Only IP Access rules take precedence.
• It applies to the whole domain and may challenge API and mobile app traffic, including uptime monitors, payment webhooks and some integrations.
• Its JavaScript detections can't be disabled, and sites with a strict Content Security Policy need to allow /cdn-cgi/challenge-platform/.

Turn it on for a simple brochure or WordPress site; leave it off if webhooks, an app or integrations hit your domain. Check Security > Analytics > Events afterwards to see what's being challenged.

AI bot controls

Cloudflare has replaced the single legacy Block AI bots toggle, which it deprecated on 15 September 2026. The newer controls are under Security Settings > Configure AI bot policies, split into categories:

• Search: crawlers that index content to answer questions later.
• Agent: automated tools acting in real time on a person's behalf.
• Training: crawlers that collect content to train models, including mixed-purpose crawlers.

Each can be set to Block (on all pages), Block on pages with ads, or Allow. Since 15 September 2026, new domains default to blocking Training and Agent bots on pages with ads while allowing Search.

For most small businesses, allowing Search and Agent traffic is sensible, because those bots are how your business gets mentioned in AI answers. Blocking Training is a business decision about whether you want your content used for model training. You can check which AI crawlers your robots.txt currently allows with our AI crawler checker.

WAF managed rules on the free plan

The free plan includes the Cloudflare Free Managed Ruleset, a subset of the full Cloudflare Managed Ruleset, and Cloudflare's WAF docs say it is deployed by default on free plans. The full managed ruleset, the OWASP Core Ruleset and the exposed credentials check need a paid plan.

What to do:

1. Open Security > WAF > Managed rules and confirm the Free Managed Ruleset is enabled.
2. Don't disable it to fix a false positive. Check the event in Security > Analytics > Events and add a targeted exception instead.

Our explainer on what a WAF is covers what a managed ruleset can and cannot catch.

DNS: proxy web records, keep email records DNS-only

In DNS > Records, each A, AAAA and CNAME record shows an orange cloud (Proxied) or grey cloud (DNS only). Cloudflare's docs say only A, AAAA and CNAME records can be proxied at all; MX and TXT records are always DNS-only.

Never proxy a hostname that receives email. Cloudflare does not proxy SMTP traffic on port 25 by default, so a proxied mail host sends mail servers to Cloudflare's IP addresses instead of yours. Cloudflare recommends a dedicated hostname for email, separate from your proxied web hostname. Google Workspace and Microsoft 365 users usually point MX records at Google or Microsoft hostnames, so the risk mainly applies to cPanel-hosted mail. After any DNS change, check your records with our DNS lookup tool.

Settings summary

Once you're done, check the result from the outside. Our SSL checker confirms the certificate visitors see, and you can run a free website audit to check HTTPS redirects, security headers and page speed together.

Frequently asked questions

Why does my site show "too many redirects" after adding Cloudflare?

This is almost always Flexible SSL combined with an HTTPS redirect on your server. Install a certificate on your origin, switch the encryption mode to Full (strict), and clear your browser cache.

Should I set Cloudflare's minimum TLS version to 1.3?

Not usually. TLS 1.2 as the minimum, with TLS 1.3 enabled, blocks outdated protocols while still supporting older devices. Only set 1.3 as the minimum if you have tested your audience and integrations.

Does Cloudflare cache my HTML pages on the free plan?

Not by default. Cloudflare caches static files such as images, CSS and JavaScript by file extension. You can cache HTML with a cache rule, but only do so on sites with no logged-in or per-user content.

Should my MX record be proxied in Cloudflare?

MX records cannot be proxied, and the mail server hostname they point to should be set to DNS only. Proxying a mail hostname sends email traffic to Cloudflare, which does not proxy SMTP by default, so mail delivery fails.

Related reading

• Does a Small Business Website Need DDoS Protection?: Does a small business website need DDoS protection? Usually a free CDN layer is enough. Learn the real risks, what your host covers and how to prepare cheaply.
• Is My Website Down or Just Me? How to Tell in 5 Minutes: Work out whether your website is down for everyone or only for you, find the broken layer (DNS, hosting, SSL, CDN or your own network) and know who to call.

Sources

• Cloudflare: Full (strict) encryption mode
• Cloudflare: Encryption modes and Automatic SSL/TLS
• Cloudflare: HTTP Strict Transport Security
• Cloudflare: TLS protocols
• Cloudflare: Default cache behaviour
• Cloudflare: Cache Rules
• Cloudflare: Block AI bots and AI bot policies
• Cloudflare: Proxy status use cases