How I Configure Cloudflare for My Website

Ammar Najjar · Posted on July 22, 2026, cloudflareinfrastructureperformanceweb-development

Open your Cloudflare dashboard today and you’ll find dozens of features for improving performance, security, and reliability. Some are enabled by default, others are recommended, and new capabilities appear regularly as the platform evolves. With so many options available, I wanted to better understand how each setting contributed to my website.

After migrating my website to Astro (see rebuilding my website with astro post) and hosting it entirely on Cloudflare Workers (see from github pages to cloudflare post, and my new website architecture post), I realized I had never properly reviewed my Cloudflare configuration. Some settings were defaults I did not question, and a few sounded useful enough that I turned them on without revisiting the decision later.

Over time, my setup had naturally evolved alongside the website. As the platform, framework, and infrastructure changed, so did the configuration. Rather than relying on decisions made at different stages of the project’s evolution, I took the opportunity to revisit every setting with fresh eyes.

I reviewed every page of the Cloudflare dashboard, read the official documentation for each feature, and evaluated whether it made sense for my website today. This article walks through the decisions I made, the reasoning behind them, and the configuration I ultimately settled on.

My Approach

Before changing any settings, I defined a few simple principles to guide every decision.

I enable features that provide clear benefits without adding complexity or requiring changes to my application. If a feature solves a problem my website doesn’t have, I leave it disabled. And when a setting changes application behavior, I only enable it if the benefits clearly outweigh the trade-offs.

These principles kept the review focused and ensured that every enabled feature had a clear purpose.

These principles are tailored to my website and the way I built it. An enterprise angular website may benefit from features that I intentionally leave disabled. An API serving dynamic content will likely require a very different caching strategy. For a static website built with a modern framework, however, these guidelines provide a simple and consistent way to evaluate each setting and focus only on the changes that add real value.

Network

The Network page was not what I initially expected, but in a good way.

I opened it expecting to spend time tuning network settings for better performance. Instead, I discovered that most options are designed for protocol support, compatibility, or specific infrastructure requirements rather than performance optimization. For a modern website running on Cloudflare Workers, the default configuration is already well chosen, which means there is very little to adjust unless your application has specific networking needs.

In the end, I made very few changes on this page, which says a lot about Cloudflare’s default configuration. For a modern website, the defaults are already well chosen.

I kept IPv6 enabled because it is the modern Internet standard and Cloudflare handles compatibility automatically. WebSockets also remain enabled. My website doesn’t use them today, but supporting them has virtually no downside and keeps the door open for future interactive features.

Pseudo IPv4 and gRPC stay disabled because they solve problems my website simply doesn’t have. My infrastructure fully supports IPv6, and I don’t expose any gRPC services, so enabling either feature would only add unnecessary configuration.

I left IP Geolocation enabled since it provides useful visitor location data through the CF-IPCountry header at essentially no cost. I also enabled Onion Routing because it improves accessibility for Tor users and aligns with my goal of making the website available to as many people as possible.

Caching

Caching is where Cloudflare starts delivering some of its biggest performance gains, so I expected to spend the most time fine-tuning these settings. Instead, the more I explored the available options, the more I realized that modern frameworks and Cloudflare’s default caching behavior already complement each other remarkably well. Rather than chasing small theoretical improvements, the goal became understanding which settings genuinely add value and which are better left alone.

The caching review reinforced one simple idea. Modern frameworks and Cloudflare already work remarkably well together. Astro generates fingerprinted assets, and Cloudflare caches them efficiently at the edge, leaving very little to optimize manually.

I kept Caching Level at Standard and Browser Cache TTL at 4 hours, which provides a good balance between fast repeat visits and timely updates. I also enabled Crawler Hints, allowing Cloudflare to notify search engines when content changes.

The only feature I left disabled is Always Online. Since my website runs entirely on Cloudflare’s infrastructure, serving archived pages during an outage adds little value.

Finally, Development Mode is an excellent tool while testing changes, but it should always be disabled afterwards. Otherwise, you might spend hours wondering why your website suddenly feels slower.

Content Optimization

This was the section I was most curious about. Cloudflare has introduced several optimization features in recent years, and reviewing them made it clear that not all deliver the same value. Some provide immediate benefits with almost no effort, while others are designed for use cases that modern frameworks already handle well.

These are some of my favorite optimizations. Many of these features can improve performance or privacy with a single click, making them easy additions to a modern website.

Speed Brain was an immediate choice. It uses the browser’s Speculation Rules API to prefetch pages that visitors are likely to open next, making navigation feel faster without requiring any code changes.

Cloudflare Fonts was another feature I was happy to discover. It serves Google Fonts through your own domain, improving privacy while reducing reliance on external requests.

I also enabled Auto Minify, Early Hints, and Automatic HTTPS Rewrites. Each contributes small but worthwhile improvements, and together they help deliver a faster, more polished browsing experience.

Other features, such as Rocket Loader and Opportunistic Encryption, remain available if my website’s requirements change in the future. For my current setup, the existing build process and HTTPS configuration already provide the intended benefits, allowing the overall configuration to stay simple and predictable.

Protocol Optimization

This section was refreshingly straightforward. Modern transport protocols have matured to the point where they form the foundation of today’s web, and for a new website, the recommended defaults are already exactly what you want.

HTTP/2 improves how browsers download resources by allowing multiple requests to share a single connection. HTTP/3 builds on that with QUIC, reducing connection times and improving performance on less reliable networks.

On the security side, TLS 1.3 delivers faster encrypted connections while adopting modern cryptographic standards. 0-RTT Connection Resumption further improves the experience for returning visitors by reducing the time needed to reconnect securely.

For a modern website, these features simply belong in the foundation. They require no ongoing maintenance, are widely supported, and provide measurable improvements to both performance and security.

Security

Before a request even reaches my application, Cloudflare is already filtering malicious traffic, mitigating attacks, and protecting the website at the edge.

One aspect I particularly appreciate is how approachable Cloudflare’s security features are. Bot Fight Mode, Browser Integrity Check, and DDoS Protection all work automatically, providing a solid layer of protection without requiring custom firewall rules or ongoing tuning.

Together, they help filter malicious traffic, challenge suspicious bots, and absorb large-scale attacks before requests ever reach the application. For a personal website, they provide an excellent balance between strong security and minimal maintenance, allowing me to focus on building the site instead of managing its defenses.

Looking Back

This review gave me a much deeper appreciation for how thoughtfully Cloudflare is designed. Rather than focusing on changing settings, I focused on understanding them and confirming they aligned with my website’s needs.

Every feature I enabled has a clear purpose, and together they create a well-balanced configuration. What impressed me most is how Cloudflare’s services, from DNS and CDN to caching, performance, and security, work together as a cohesive platform.

If you review your own configuration, take the time to understand what each setting does and how it fits your website. Building a configuration with intention is far more valuable than simply enabling every available feature.

What Would You Change?

Cloudflare continues to evolve, so I’ll keep reviewing my configuration and update this article as new features become available.

How do you configure your Cloudflare dashboard? Have you discovered a feature that’s made a noticeable difference? Share your recommendations in the comments. I’d love to hear your experience.