Cloudflare Free Plan for Small Business Websites: Speed, SSL and Protection

Cloudflare sits between your visitors and your hosting server. It's used by millions of websites, and its free plan offers features that small businesses would struggle to set up on their own: a global content delivery network (CDN), free SSL, protection against many attacks, and tools to control bots. For a business website on shared hosting, it can be a useful upgrade at no cost.

It's not magic, and it's not always necessary. Here's what it does, how to set it up, and where people go wrong.

What Cloudflare's free plan gives you

Features and limits change over time, so check Cloudflare's current plan page.

When it's worth using

• Your hosting is slow or under heavy load from bots.
• You've faced spam attacks, login brute-force attempts or traffic floods.
• You have visitors in several regions or countries.
• You want simple control over AI crawlers. See AI crawlers and robots.txt.

If your website is small, fast and on good hosting with a built-in CDN, the gain may be modest. It's still useful for security and DNS.

How to set it up

1. Create a free Cloudflare account and add your domain.
2. Cloudflare scans your existing DNS records. Compare carefully with your current records — especially MX, TXT (SPF, DKIM, DMARC) and any subdomains. Add anything missing.
3. Records for the website (A, CNAME for www) can be "proxied" (orange cloud). Mail-related records must stay "DNS only" (grey cloud).
4. Change your domain's nameservers at the registrar to the two Cloudflare nameservers shown.
5. Wait for activation, then set SSL/TLS mode.

The SSL setting that causes most problems

In SSL/TLS settings, choose Full (strict) if your hosting has a valid SSL certificate (most do, often free). Avoid Flexible: it encrypts only between visitor and Cloudflare, and combined with an HTTPS redirect on your server it often causes an endless redirect loop ("too many redirects").

If your server's .htaccess checks for HTTPS, it may also need to recognise Cloudflare's forwarded protocol header to avoid loops.

Useful free settings

• Always Use HTTPS — redirects http to https at the edge.
• Brotli compression — smaller files.
• Caching level standard with a reasonable browser cache TTL.
• A security rule to challenge visitors to /admin or login pages from outside India, if your team is in India.
• Bot Fight Mode — test carefully; it can sometimes block legitimate services.

Mistakes to avoid

1. Losing email because MX or TXT records weren't copied before switching nameservers.
2. Proxying mail records — mail servers need the real IP.
3. Caching dynamic pages like admin panels, carts or forms with aggressive "cache everything" rules.
4. Forgetting Cloudflare when debugging — after updating CSS or images, you may need to purge the cache.
5. Blocking Googlebot with overly strict firewall rules.

Is the real IP visible in your logs?

When proxied, your server sees Cloudflare's IP for every visitor. If your website records visitor IPs (for example for spam rate limiting), use the CF-Connecting-IP header, but only trust it for requests that genuinely come from Cloudflare's IP ranges.

Frequently Asked Questions

Is Cloudflare free plan enough for a business website?

For most small and medium business websites, yes. Paid plans add advanced firewall, image optimisation and support features.

Will Cloudflare improve my Google rankings?

Not directly. It can improve speed and uptime, which help user experience and Core Web Vitals.

Can I use Cloudflare with Hostinger?

Yes. Hostinger also offers its own CDN on some plans; use one approach and test carefully.

How do I undo it?

Change nameservers back to your previous provider, making sure all DNS records exist there.

Want a faster, safer website?

Joboo Web sets up Cloudflare, SSL and security correctly. See speed fixes for shared hosting, hosting services or contact us.