Get the most from
Cloudflare — properly configured
Most businesses sign up for Cloudflare but barely scratch the surface of what it can do. W3IT configures, manages and optimises your Cloudflare account so you get real security, real performance and real cost savings — not just a free SSL certificate.
This website runs entirely on Cloudflare. W3IT.com is hosted on Cloudflare Pages, protected by Turnstile and WAF rules, and uses Cloudflare Workers and D1 for form processing and lead storage. We recommend what we actually use. Read the build →
Cloudflare is only as good as its configuration
Cloudflare is extraordinarily capable — but the default settings leave most of its security and performance features switched off. Most accounts are vastly under-configured.
- Default WAF rules are too permissive Cloudflare's managed WAF ruleset is on by default but set to "log only". Without tuning, it detects attacks without blocking them.
- DNS misconfigured after setup Pointing MX records through the Cloudflare proxy breaks email delivery. Orange-clouding records that shouldn't be proxied is a common setup error.
- Page Rules and Cache Rules unused Without cache configuration, Cloudflare proxies your origin on every request instead of serving from edge — missing the biggest performance and cost benefit.
- Origin IP exposed Even with Cloudflare active, the origin server IP is often discoverable through DNS history or email headers — bypassing all protection.
Six areas of your Cloudflare account
A thorough Cloudflare setup covers security, performance, DNS hygiene and edge compute.
DNS & Proxy Configuration
Correct proxy settings for every record type, MX record handling, origin IP protection, DNSSEC configuration and TTL optimisation. We also audit for legacy records that may be leaking your origin IP or creating email delivery issues.
WAF & Security Rules
Managed ruleset tuning, custom firewall rules for your specific application, rate limiting on login and API endpoints, and bot score configuration. We move WAF rules from "log" to "block" mode once tuning is complete — the step most accounts never take.
Cache & Performance
Cache Rules for static assets and full-page caching where appropriate, Tiered Cache configuration, image optimisation with Polish, and Rocket Loader for JS deferral. Properly cached sites typically see 60–90% reductions in origin requests.
SSL/TLS & HTTPS
Full (Strict) SSL mode, TLS 1.2 minimum with TLS 1.3 enabled, HSTS headers, automatic HTTPS rewrites and certificate transparency monitoring. Many sites are still running Flexible SSL — which means traffic from Cloudflare to your origin is unencrypted.
Cloudflare Pages & Workers
We deploy and manage static sites on Cloudflare Pages, build edge functions with Workers for form handling, authentication and API proxying, and use D1 (edge SQLite) and KV for data storage — all without a traditional server.
Monitoring & Alerts
Cloudflare Analytics configuration, threshold-based security event alerts, origin health checks and uptime monitoring. You get visibility into traffic patterns, attack volume and cache hit rates — without adding a third-party analytics tool.
What we commit to
Zero-Downtime Changes
All DNS changes are planned and staged. We never make live changes that could interrupt email delivery or website availability without a tested rollback plan.
Full Change Documentation
Every configuration change is documented. You always have a complete record of what was changed, when, and why — in your Cloudflare account and with us.
Your Account, Your Control
We work inside your Cloudflare account — we never hold your credentials or create a dependency on our own account. You retain full ownership at all times.
No Upselling
We'll tell you if the free plan is sufficient for your needs. Many SMEs don't need Pro or Business tier — we recommend only what you'll genuinely benefit from.
Get more from your Cloudflare account
Whether you're already on Cloudflare or considering a move, get in touch for a free review of your current DNS and security configuration.