Cloudflare sits between visitors and your origin server, and most people use it only as a DNS provider. That leaves ten genuinely useful features untouched—features that block bot traffic, shrink images, enforce HTTPS, and stop comment spam without a plugin.
I'll walk through each tool, explain what it does in plain terms, and show you the exact toggles to flip. No upsells, no vague promises. If you can log into your Cloudflare dashboard, you can finish this in one sitting.
What Cloudflare actually does
Cloudflare is a reverse proxy and content delivery network. When you point your domain's nameservers to Cloudflare, your DNS records live on their platform and all HTTP/HTTPS traffic routes through their edge servers before reaching your host.
That position in the middle gives Cloudflare three levers: it can inspect requests and block bad actors, cache static assets closer to visitors, and rewrite responses on the fly to compress images or strip tracking scripts.
Most of these features sit in the dashboard under the Speed, Security, and Network tabs. The free tier unlocks almost everything I'll cover here.
1. Auto Minify (CSS, JavaScript, HTML)
Minification strips whitespace, comments, and line breaks from code files. A 120 KB JavaScript bundle might drop to 85 KB. Multiply that across every visitor and you save bandwidth and cut load time.
Cloudflare does this at the edge, so your origin files stay readable for debugging.
Where to find it: Dashboard → Speed → Optimization
How to enable:
- Tick the checkboxes for JavaScript, CSS, and HTML.
- Purge your cache (Dashboard → Caching → Configuration → Purge Everything) so visitors get the minified versions immediately.
You'll see the effect in your browser's network panel: response sizes shrink and the cf-minified header appears.
One gotcha: if your site already uses a build tool that minifies assets (Webpack, Vite, Laravel Mix), Cloudflare's second pass won't hurt but it won't help much either. The real win is for hand-coded sites or WordPress themes that ship unoptimized CSS.
2. Brotli compression
Brotli is a compression algorithm that beats Gzip by 15–20% on text files. Your server might already support it, but if you're on shared hosting with an old Apache config, it probably doesn't.
Cloudflare enables Brotli automatically for all proxied traffic when the visitor's browser sends the Accept-Encoding: br header.
Where to find it: Dashboard → Speed → Optimization → Brotli (it's a single toggle).
Turn it on. Done.
Check the Content-Encoding header in Chrome DevTools (Network tab, click any HTML or JSON response). You should see br instead of gzip.
3. Rocket Loader
Rocket Loader defers JavaScript execution until after the page renders. Scripts load asynchronously and the browser paints content faster.
This sounds great, but it rewrites your JavaScript in ways that can break inline event handlers, analytics snippets, and some WordPress plugins.
Where to find it: Dashboard → Speed → Optimization → Rocket Loader
When to use it: small brochure sites with simple scripts and no complex interactions. Test thoroughly on a staging domain first.
When to skip it: e-commerce, membership sites, anything with forms or live chat. In support tickets I handled, Rocket Loader was the culprit behind "Add to Cart does nothing" reports more often than any other feature.
If you enable it, open your site in an incognito window and click every button. Check the browser console for errors. If anything breaks, turn it off and use a dedicated lazy-load plugin instead.
4. Mirage (image lazy-loading and optimization)
Mirage loads images only when they scroll into view and serves low-resolution placeholders first. Think of it as native lazy-loading before browsers supported it natively.
The catch: Cloudflare retired Mirage for new accounts and replaced it with a paid "Image Resizing" service. If your account predates 2023 you might still see the toggle, but don't rely on it long-term.
For new setups, modern browsers handle lazy-loading if you add loading="lazy" to your <img> tags. WordPress does this automatically since version 5.5.
5. Polish (automatic image compression)
Polish compresses JPEG and PNG images as they pass through Cloudflare's edge. You upload a 2 MB photo; visitors download a 400 KB version. Your origin file stays untouched.
Free plans get Lossless mode (no quality loss, smaller gains). Paid plans unlock Lossy (higher compression, slight quality hit) and WebP conversion.
Where to find it: Dashboard → Speed → Optimization → Polish
Pick Lossless and enable WebP if your plan allows it. Modern browsers understand WebP, and it cuts file sizes by 25–35% compared to JPEG.
Purge your cache after enabling Polish, then check an image URL. The response header cf-polished confirms it worked.
Why this matters on shared hosting: image compression usually happens at build time or upload time. If your client uploads raw photos straight from their phone, Polish fixes it server-side without extra plugins or manual resizing.
6. Always Use HTTPS
This feature redirects all http:// requests to https://. No .htaccess rules, no plugin overhead. One toggle enforces encryption site-wide.
Where to find it: Dashboard → SSL/TLS → Edge Certificates → Always Use HTTPS
Flip it on.
Visitors who type http://example.com or follow an old link get a 301 redirect to https://example.com. Search engines see the redirect and update their index. Your server never handles the HTTP request—Cloudflare does.
Check it: type your domain without https:// in a private browser window and watch the URL bar. You should land on the secure version instantly.
7. Automatic HTTPS Rewrites
Even if your page loads over HTTPS, hardcoded http:// links in your HTML (images, scripts, stylesheets) trigger mixed-content warnings and break the padlock icon.
Automatic HTTPS Rewrites scans outgoing HTML and changes http:// to https:// for resources known to support encryption.
Where to find it: Dashboard → SSL/TLS → Edge Certificates → Automatic HTTPS Rewrites
Enable it if you inherited a site with old embedded content or migrated from HTTP to HTTPS and missed some links.
The better fix: update your HTML and database directly. Run a search-replace in WordPress (use the Better Search Replace plugin or WP-CLI). HTTPS Rewrites is a safety net, not a permanent solution.
So what if you need more control over bad traffic?
Cloudflare's firewall features sit one level deeper. The dashboard calls it Security → WAF (Web Application Firewall). The free plan gives you five custom rules.
8. Firewall Rules (now called WAF Custom Rules)
Firewall rules let you block, challenge, or allow requests based on IP address, country, user agent, URL path, or HTTP headers. Think of it as .htaccess on steroids, applied at the edge before traffic hits your server.
Where to find it: Dashboard → Security → WAF → Custom rules → Create rule
Example use case: block all POST requests to wp-login.php except from your office IP.
How to set it up:
- Click Create rule.
- Name it "Block wp-login except office".
- Set Field to "URI Path", Operator to "equals", Value to
/wp-login.php. - Add a second condition: Field = "IP Source Address", Operator = "does not equal", Value =
203.0.113.50(replace with your real IP). - Set Action to "Block".
- Deploy.
Now brute-force bots get a 403 before they touch your server. Your wp-login attempts drop to near zero, and your access logs stay clean.
You can also challenge visitors with a CAPTCHA instead of an outright block. Useful for rate-limiting API endpoints or comment forms without breaking legitimate users.
9. Bot Fight Mode
Bot Fight Mode uses heuristics and JavaScript challenges to stop automated scrapers, credential stuffing, and spam bots.
Where to find it: Dashboard → Security → Bots → Configure Super Bot Fight Mode (free tier gets a simplified version called "Bot Fight Mode").
Turn it on. Cloudflare serves an interstitial challenge to suspected bots and lets humans through.
Trade-off: some monitoring tools, uptime checkers, and RSS readers fail the challenge because they don't execute JavaScript. If your site relies on third-party integrations that hit your pages programmatically, whitelist their IPs in a firewall rule before enabling Bot Fight Mode.
10. Email Address Obfuscation
Every mailto: link and plain-text email on your page is a target for spam harvesters. Email Address Obfuscation rewrites addresses in your HTML using JavaScript, so scrapers see garbled text but real visitors see the correct link.
Where to find it: Dashboard → Scrape Shield → Email Address Obfuscation
Enable it. Check your page source—email addresses now look like encoded strings wrapped in Cloudflare's obfuscation script.
Does it work? Your spam volume won't hit zero, but I've seen inbox spam drop by half on contact pages after turning this on. Pair it with a CAPTCHA on your contact form for better results.
Caching: the silent performance multiplier
Cloudflare caches static files (images, CSS, JS) by default, but HTML pages require explicit rules. Free plans can set cache TTL and purge the cache manually. Paid plans unlock Page Rules for granular control.
Where to find it: Dashboard → Caching → Configuration
Default caching behavior: Cloudflare respects your origin's Cache-Control headers. If your server says "don't cache this," Cloudflare obeys.
To cache everything:
- Go to Rules → Page Rules (free plans get three rules).
- Create a rule for
example.com/*. - Add setting Cache Level: Cache Everything.
- Set Edge Cache TTL to
7200(2 hours) or higher. - Save and deploy.
Now Cloudflare caches HTML too. Your origin server handles far fewer requests. Hosting CPU drops, page speed jumps.
The catch: dynamic content (logged-in users, shopping carts) breaks if you cache it. Use Page Rules carefully. A safer approach: cache only specific static paths like /blog/* or /docs/*.
Purge the cache after any content change (Dashboard → Caching → Configuration → Purge Everything). Cloudflare also offers purge-by-URL if you know exactly which page changed.
Testing your changes
After enabling these features, run through this checklist:
- Open your site in an incognito window.
- Check the browser console (F12) for JavaScript errors.
- Test forms, buttons, and interactive elements.
- Verify images load and display correctly.
- Use Chrome DevTools (Network tab) to inspect headers: look for
cf-cache-status,cf-polished,content-encoding: br. - Check mobile: some features affect mobile differently.
If something breaks, turn off features one by one until you find the culprit. Rocket Loader and Page Rules cause 90% of issues in my experience.
Monitoring what Cloudflare is doing
The Analytics tab shows requests blocked, bandwidth saved, and cache hit ratio. Free plans get 24 hours of data; paid plans get more history.
Dashboard → Analytics → Traffic
Watch Threats Mitigated and Requests. If you see a spike in blocked requests after enabling Bot Fight Mode, it's working. If cache hit ratio stays under 80%, your cache rules need tuning or your origin is sending no-cache headers.
Cloudflare also logs every request in real-time if you enable Firewall Events (Dashboard → Security → Events). See which IPs got blocked and why.
What to check first when things break
Cloudflare sits between visitors and your server, so diagnosing issues means asking: is the problem at the edge or the origin?
Symptom: pages won't load
Check your SSL/TLS mode (Dashboard → SSL/TLS). If it's set to Flexible and your origin enforces HTTPS, you'll get a redirect loop. Change it to Full or Full (Strict).
Symptom: changes don't appear
Purge your cache. Cloudflare might be serving stale HTML.
Symptom: forms stopped working
Disable Rocket Loader. Check firewall rules—maybe you accidentally blocked POST requests.
Symptom: analytics or tracking scripts vanished
Some features (Rocket Loader, Zaraz) rewrite scripts. Check your page source and compare it to your origin HTML. Bypass Cloudflare temporarily by editing your hosts file to point your domain directly at your server IP, then test.
Start with the easy wins
Enable Auto Minify, Brotli, and Always Use HTTPS first. They're harmless and immediately measurable. Run a speed test before and after (use WebPageTest or GTmetrix). You'll see smaller payload sizes and faster load times.
Once those are stable, experiment with Polish, firewall rules, and caching. Leave Rocket Loader off unless you understand the trade-offs.
Cloudflare ships new features constantly, but the tools I covered here are stable, well-documented, and solve real hosting problems. Most take under five minutes to set up. The hard part is remembering they exist.