This guide will show how you can set up a website to use Cloudflare on a VM hosted on Vultr and Namecheap
I have a number of guides on moving hasting away form CPanel, Setting up VM’s on AWS, Vultr or Digital Ocean along with installing and managing WordPress from the command line. This post will show how to let Cloudflare handle the DNS for the domain.
Update 2018: For the best performing VM host (UpCloud) read my guide on the awesome UpCloud VM hosts (get $25 free credit by signing up here).
Snip from here “Cloudflare’s enterprise-class web application firewall (WAF) protects your Internet property from common vulnerabilities like SQL injection attacks, cross-site scripting, and cross-site forgery requests with no changes to your existing infrastructure.”
Buy a Domain
Buy a domain name from Namecheap here.
Cloudflare Benefits (Free Plan)
- DDoS Attack Protection (Huge network to absorb attacks DDoS attacks over 600Gbps are no problem for our 15 Tbps networks)
- Global CDN
- Shared SSL certificate (I disabled this and opted to use my own)
- Access to audit logs
- 3 page rules (maximum)
View paid plan options here.
Cloudflare CDN map
Cloudflare CDN says it can load assets up to 2x faster, 60% less bandwidth from your servers by delivering assets from 127 data centres.
Setup
You will need to sign up at cloudflare.com
After you create an account you will be prompted to add a site
Cloudflare will pull your public DNS records to import.
You will be prompted to select a plan (I selected free)
Verify DNS settings to import.
You will now be asked to change your DNS nameservers with your domain reseller
TIP: If you have an SSL cert (e.g Lets Encrypt) already setup head to the crypto section and select ” Full (Strict)” to prevent ERR_TOO_MANY_REDIRECTS errors.
Cloudflare UI
I asked Twitter if they could kindly load my site so I could see if Cloudflare dashboard/stats were loading.
Could I kindly ask if you are reading this that you visit https://t.co/9x5TFARLCt, I am writing a @Cloudflare blog post and need to screenshot stats. Thanks in advance
— Simon Fearby (Developer) (@FearbySoftware) March 13, 2018
The Cloudflare CTO responded. 🙂
Sure thing 🙂
— John Graham-Cumming (@jgrahamc) March 13, 2018
Confirm Cloudflare link to a domain from the OSX Comand line
Caching Rule
I set up the following caching rule to cache everything for 8 hours instead of WordPress pages
“fearby.com.com/wp-*” Cache level: Bypass
“fearby.com.com/wp-admin/post.php*” Cache level: Bypass
“fearby.com/*” Cache Everything, Edge Cache TTL: 8 Hours
Cache Results
Cache appears to be sitting at 50% after 12 hours. having cache os dynamic pages out there is ok unless I need to fix a typo, then I need to login to Cloudflare and clear the cache manually (or wait 8 hours)
Performance after a few hours
DNS times in gtmetrix have now fallen to a sub 200ms (Y Slow is now a respectable A, it was a C before). I just need to wait for caching and minification to kick in.
webpagetest.org results are awesome
See here: https://www.webpagetest.org/result/180314_PB_7660dfbe65d56b94a60d7a604ca250b3/
- Load Time: 1.80s
- First Byte 0.176s
- Start Render 1.200s
Google Page Speed Insights Report
Mobile: 78/100
Desktop: 87/100
Check with https://developers.google.com/speed/pagespeed/insights/
Update 24th March 2018 Attacked?
I noticed a spike in and traffic (incoming and threats) on the 24th of March 2018.
I logged into Cloudflare on my mobile device and turned on Under Attack Mode.
Cloudflare was now adding a delay screen in the middle of my initial page load. Read more here. A few hours after the Attach started it was over.
After the Attack
I looked at the bandwidth and found no increase in traffic from my initial host VM. Nice.
Thanks, Cloudflare.
Cloudflare Pros
- Enabling Attack mode was simple.
- Soaked up an attack.
- Free Tier
- Many Reports
- Option to force HTTPS over HTTP
- Option to ban/challenge suspicious IP’s and set challenge timeframes.
- Ability to setup IP firewall rules and Application Firewalls.
- User-agent blocking
- Lockdown URL’s to IP’s (pro feature)
- Option to minify Javascript, CSS and HTML
- Option to accelerate mobile links
- Brotli compression on assets served.
- Optio to enable BETA Rocket loader for Javascript performance tweaks.
- Run Javascript service workers from the 120+ CDN’s
- Page/URL rules o perform custom actions (redirects, skip cache, Encryption etc)
- HTTP/2 on, IPV6 ON
- Option to setup load balancing/failover
- CTO of Cloudflare responded in Twitter 🙂
- Option to enable rate limiting (charged at 10,000 hits for $0.05c)
- Option to block countries (pro feature)
- Option to install apps in Cloudflare like(Goole Analytics,
Cloudflare Cons
- No more logging into NameCheap to perform DNS management (I now goto Cloudflare, Namecheap are awesome).
- Cloudflare Support was slow/confusing (I ended up figuring out the redirect problem myself).
- Some sort of verify Cloudflare Setup/DNS/CDN access would be nice. After I set this up my gtmetrix load times were the same and I was not sure if DNS needs to replicate? Changing minify settings in Cloudflare did not seem to happen.
- WordPress draft posts are being cached even though page riles block wp-admin page caching.
- Would be nice to have ad automatic Under Attack mode
- Now all sub-domains were transferred in the setup ( id did not know for weeks)
Cloudflare status
Check out https://www.cloudflarestatus.com/ for status updates.
Don’t forget to install the CloudFlare Plugin for WordPress if you use WordPress.
More Reading
Check out my OWASP Zap and Kali Linux self-application Penetration testing posts.
I hope this guide helps someone.
Ask a question or recommend an article
[contact-form-7 id=”30″ title=”Ask a Question”]
Revision History
v1.8 host Command from the OSX CLI
v1.7 Subdomain error
v1.6 Cloudflare Attack
v1.5 WordPress Plugin
v1.4 More Reading
v1.3 added WAF snip
v1.2 Added Google Page Speed Insights and webpage rest results
v1.1 Added Y-Slow
v1.0 Initial post