Cloudflare for business: DNS, WAF, DDoS protection and the settings not to miss

The short answer: Cloudflare puts its network between visitors and the company website. It hosts the DNS zone, hides the server’s real address, absorbs DDoS attacks and filters traffic through a WAF. But these protections are only worth something if the configuration is right: proxy enabled on web records, Full (strict) SSL mode, DNSSEC enabled, and above all an origin server that cannot be reached directly. A site that is “on Cloudflare” but reachable by its IP address remains exposed.

This guide covers what Cloudflare brings to a business, the settings to check and the mistakes we come across most often. It draws on Cloudflare’s official documentation. Our own website is, incidentally, hosted on Cloudflare’s infrastructure.

What Cloudflare brings to a business

Service	What it does	Available
DNS	Hosts the domain’s zone, with DNSSEC	All plans
Proxy	Answers with Cloudflare’s addresses instead of the server’s	All plans
DDoS protection	Automatically detects and mitigates attacks, from layers 3 and 4 up to layer 7	All plans, unmetered
Certificates and HTTPS	Encrypts traffic between visitors and Cloudflare, then to the server	All plans
WAF	Custom rules, rate limiting, managed rules	Full managed rules on paid plans
Cache and performance	Caches static content close to visitors	All plans
Cloudflare One (zero trust)	Access, Gateway, Tunnel for employee access	Separate offering

Cloudflare’s documentation states that standard DDoS protection, layers 3 to 7, is included and unmetered on every plan, the free one included. For the WAF, the free plan includes custom rules, one rate limiting rule and a reduced managed ruleset; the full managed rules are reserved for the Pro, Business and Enterprise plans. We explain how an application firewall works in our guide to the WAF and web application firewall.

1. DNS: proxied or DNS-only

Every DNS record in a Cloudflare zone has two states:

• Proxied (orange cloud): Cloudflare answers with its own addresses, web traffic goes through its network, the server’s address is hidden, and the WAF, cache and DDoS protection apply.
• DNS-only (grey cloud): the DNS query returns the server’s real address, and traffic does not go through Cloudflare.

Only A, AAAA and CNAME records can be proxied. Others, such as MX or TXT, are always DNS-only. Cloudflare recommends proxying records that serve web traffic, and leaving DNS-only those used for email or third-party service verification.

Record	Recommended setting
Website (root and www)	Proxied
Web application, extranet	Proxied, with WAF and controlled access
Email MX	DNS-only (enforced)
SPF, DKIM, DMARC, verifications	DNS-only (enforced)
Autodiscover, VPN access, SIP telephony	DNS-only, the proxy only handles web traffic

Email records deserve particular care when the zone is moved: one forgotten MX or DKIM record and messages stop going out or coming in. Our guide to SPF, DKIM and DMARC and our method for migrating email to Microsoft 365 cover these records in detail.

2. Encryption: choose Full (strict)

Cloudflare offers several encryption modes between its servers and the origin server:

Mode	Visitor to Cloudflare	Cloudflare to server
Off	HTTP	HTTP
Flexible	HTTPS possible	HTTP, unencrypted
Full	HTTPS	HTTPS, without checking the server’s certificate
Full (strict)	HTTPS	HTTPS, with certificate validation

Flexible mode gives the illusion of a secure site: the padlock shows in the browser, but traffic travels in clear text between Cloudflare and the server. Cloudflare strongly recommends Full or Full (strict), the latter adding certificate validation. The server’s certificate can come from a public authority or from Cloudflare’s Origin CA.

3. DNSSEC: sign the zone

DNSSEC adds authentication to DNS answers, so that a visitor is not sent to a spoofed domain. In Cloudflare, it is enabled from the DNS settings: Cloudflare signs the zone and provides a DS record, which must then be added at the domain’s registrar. For a .ma domain, this is done with the registrar that manages the domain. Be careful during a transfer: Cloudflare asks you to disable DNSSEC at the previous provider before moving the zone.

4. Protecting the origin server: the most often forgotten point

The proxy hides the server’s address, but if that address is known (old DNS records, email hosted on the same server, a subdomain left DNS-only), an attacker can bypass Cloudflare and attack the server directly. Cloudflare’s documentation recommends several measures, from the simplest to the most robust:

1. Check DNS-only records (SPF, TXT, subdomains) so that none reveals the server’s address.
2. Do not host email on the protected server: a bounced message can reveal its address.
3. Change the server’s IP address after onboarding, since DNS history may still hold the old one.
4. Allow only Cloudflare’s addresses on the server’s or hosting firewall.
5. Enable Authenticated Origin Pulls, which ensures requests really come from Cloudflare; it requires Full or Full (strict) mode.
6. Use Cloudflare Tunnel: the server makes outbound-only connections and no longer needs a public address. It is the cleanest method for an application hosted on premises.

5. WAF and rate limiting

Once traffic is on Cloudflare, a few simple rules go a long way:

• Protect admin pages (/wp-admin/, back office, console): access limited to certain addresses or to an authenticated user.
• Rate-limit the login page and forms, to slow down password guessing and spam.
• Enable the managed rules available on your plan, starting by watching the logs before blocking.
• Filter by country only if the business justifies it: a Moroccan company working with Europe and Africa must not block its own customers.

Watch the security events regularly: Cloudflare logs which rule matched which request, which makes it possible to spot a false positive blocking a customer, or an attack pattern that deserves a new rule. On the free plan these logs are sampled, so for an application that matters, the logs are best forwarded to the company’s monitoring.

These rules complement the measures specific to the site, which we describe for securing a business WordPress website.

6. Employee access: Cloudflare One

Beyond the public site, the Cloudflare One platform applies a zero trust approach to internal access: Access authenticates the user before opening an application, Gateway filters the DNS and web traffic of computers, and Tunnel publishes an internal application without opening a port on the firewall. It is an alternative to the business VPN for some uses, and a good way never to expose remote desktop to the Internet, as we recommend for RDP access. Access relies on the existing directory, Microsoft Entra ID or Google Workspace, with two-factor authentication.

Moving a zone to Cloudflare without downtime

1. Inventory the current zone: a full copy of every record, including email, verifications and forgotten subdomains.
2. Create the zone in Cloudflare and compare it line by line with the existing one.
3. Disable DNSSEC at the previous provider if needed.
4. Change the name servers at the registrar, then check the site, email and third-party services.
5. Install a certificate on the server and switch to Full (strict).
6. Enable DNSSEC and add the DS record at the registrar.
7. Lock down the origin, then enable WAF rules in observation before blocking.
8. Secure the Cloudflare account itself: two-factor authentication, one account per administrator, no shared login. Whoever controls this account controls the website and email.

The most common mistakes

• Leaving SSL mode on Flexible.
• Forgetting an email record when moving the zone.
• Leaving the origin server reachable by its IP address.
• Keeping a DNS-only subdomain pointing to the same server as the site.
• Blocking whole countries without checking where customers come from.
• Running the Cloudflare account with a single shared login, without two-factor authentication.

How we support businesses

We start with the free initial audit: DNS zone, email records, encryption mode, origin server exposure, rules in place and security of admin accounts. We then set up or correct the configuration, in line with your on-premises firewall and your network infrastructure.

As part of our business cybersecurity in Morocco offering, exposed sites and applications are covered by 24/7 monitoring, and a critical incident is handled in under 15 minutes. Request your free initial audit: we reply within 24 business hours.