Cloudflare is a network that sits between visitors and a web server. It provides DNS and CDN services so it can reverse proxy a domain's traffic, caching static files, filtering attacks and fetching everything else from the origin server. Cloudflare says 95% of the world's Internet-connected population is within 50 milliseconds of one of its data centres.

Yes. Cloudflare's Free plan costs $0 a month and includes DNS, unmetered DDoS protection, the CDN, a Universal SSL certificate, the WAF and the Free Managed Ruleset. Cloudflare describes it as for projects that are not business-critical; Pro starts at $20 a month billed annually.

Does Cloudflare cache HTML pages?

Not by default. Cloudflare caches by file extension and does not cache HTML or JSON unless you add a Cache Rule. It also skips caching responses that set cookies or are marked private or no-store, which keeps carts and checkout pages personal to each shopper.

What Is Cloudflare? Speed Test, CDN and WAF for Ecommerce

Cloudflare is a network that sits between your visitors and your web server. According to Cloudflare's documentation, it provides DNS and CDN services so that it can reverse proxy the traffic to and from your domain: visitors connect to Cloudflare, and Cloudflare decides what to serve from its own data centres, what to block, and what to fetch from your origin server. Cloudflare says 95% of the world's Internet-connected population is within 50 milliseconds of one of its data centres. For an online shop, that makes it three things at once: a DNS provider, a content delivery network (CDN) and a security layer.

This guide explains what Cloudflare is used for, what the Cloudflare speed test actually measures, and how its cache, WAF and Turnstile settings affect Shopify, WooCommerce and Magento stores. Every product detail comes from Cloudflare's own documentation as of 28 October 2026.

What is Cloudflare used for?

When you add a domain with a full DNS setup, Cloudflare becomes its authoritative DNS provider, as its DNS overview explains. Each A, AAAA or CNAME record can then be proxied (the orange cloud) or DNS-only. A proxied record answers with a Cloudflare anycast IP address instead of your origin IP, so HTTP and HTTPS traffic flows through Cloudflare's network, where it can be cached, optimised and filtered. A DNS-only record returns your server's real IP and Cloudflare does not touch the traffic. Other record types, such as MX and TXT, are always DNS-only.

For ecommerce, the main uses are:

CDN and caching: static files such as images, CSS and JavaScript are served from the data centre closest to the shopper (default cache behaviour).
DDoS protection: available on all plans, including Free, and detected and mitigated automatically.
Web Application Firewall (WAF): managed rulesets that block known attack techniques and zero-day exploits.
Bot and form protection: Turnstile, a CAPTCHA alternative for login, registration and checkout forms.
Free TLS: a Universal SSL certificate is included on every plan, according to Cloudflare's plan comparison.

What does the Cloudflare speed test measure?

The Cloudflare speed test at speed.cloudflare.com measures your own Internet connection, not a website. It reports download and upload speed, latency, jitter and packet loss, then turns them into a Network Quality Score for streaming, gaming and video calls. Cloudflare notes that a single test can use up to 200 MB of data, and that it receives your IP address, which it truncates to /24 for IPv4 and /48 for IPv6, plus an estimate of your city and your ISP's network number (ASN).

The key point: a good result on the Cloudflare speed test tells you nothing about how fast your store loads. To test a website, Cloudflare offers Observatory in the dashboard. Its browser test loads a page in a headless browser and runs Google Lighthouse, and its real user monitoring (RUM) captures metrics from real visitors, including Interaction to Next Paint (INP), which synthetic tests cannot measure. One detail matters for UK stores: on the Free plan RUM is switched on automatically but excludes traffic from the EEA, the UK and Switzerland, so a UK-focused shop will see little real-user data there unless it uses another RUM source such as Google's Core Web Vitals report.

You want to test	Use	What it measures
Your own broadband or office connection	speed.cloudflare.com	Download, upload, latency, jitter, packet loss
A single page under lab conditions	Observatory browser test	Google Lighthouse metrics in a headless browser
What real shoppers experience	Observatory RUM	Real-user metrics including INP (Free plan excludes EEA, UK and CH traffic)

Is Cloudflare free?

Yes, there is a Free plan at $0 a month, which Cloudflare's plans page describes as for personal or hobby projects that are not business-critical. It includes DNS, unmetered DDoS protection, the CDN, a Universal SSL certificate, the WAF and the Free Managed Ruleset. Pro costs $20 a month billed annually or $25 billed monthly, and Business $200 a month billed annually or $250 billed monthly; larger plans are priced by contract. For a store that takes real revenue, the paid tiers add features such as image optimisation, so check the comparison table against what your platform already provides.

How Cloudflare caching works on an online shop

Out of the box, Cloudflare caches by file extension, not by content type, and it does not cache HTML or JSON by default. So your product images, CSS and JavaScript are cached at the edge, but your product and category pages are still fetched from your server on every request unless you add a Cache Rule. Cloudflare also skips caching when the response has a Set-Cookie header, when Cache-Control is private, no-store, no-cache or max-age=0, or when the request is not a GET.

For a store, that default is the safe one. Carts, account pages and checkout are personal to each shopper, and caching them by mistake can show one customer another customer's data. If you write a cache-everything rule to cut server load, exclude the cart, checkout, account and admin paths, and make sure pages that set session cookies are never cached. Cloudflare also sends only one request at a time per data centre for an uncached file (a cache lock), which protects a busy origin during a sale.

WordPress and WooCommerce sites can use Automatic Platform Optimization (APO), which uses Cloudflare Workers to cache dynamic WordPress pages at the edge for a fast, consistent time to first byte. It needs the Cloudflare for WordPress plugin, and Cloudflare's plans page lists it at $5 a month on the Free plan and included with Pro, Business and Enterprise. Test it carefully on WooCommerce, for the same cart and checkout reasons.

Cloudflare and Shopify

Cloudflare partners with Shopify to give Shopify stores its performance and security benefits. If you also have your own Cloudflare zone, you can proxy your Shopify domain through it first, a setup Cloudflare calls O2O (orange-to-orange), by adding a proxied CNAME record that points your shop domain at shops.myshopify.com. O2O works on any Cloudflare plan. Two rules from the documentation are worth knowing before you try it:

Workers and Snippets are disabled on the /checkout path.
Do not enable Always Use HTTPS. It redirects the /.well-known/acme-challenge/* path that Shopify uses to issue and renew your Let's Encrypt certificate. Use a redirect rule that excludes that path instead.

Most Shopify merchants do not need their own zone at all. O2O is for teams that want their own caching, Workers or rules in front of the store, and it adds a second Cloudflare configuration in front of the store that your team has to maintain.

Cloudflare WAF and Turnstile for WooCommerce and Magento

Self-hosted platforms carry their own application risk, which is where the WAF earns its place. The Cloudflare Managed Ruleset covers known attack techniques and zero-day vulnerabilities and is updated frequently, and the OWASP Core Ruleset scores requests against the OWASP ModSecurity Core Rule Set. Rules carry tags, such as wordpress, so you can tune a group of them at once.

A WAF is not a substitute for patching, though. When Sansec published its advisory on the PolyShell Magento vulnerability, it noted that Cloudflare had not published a WAF rule covering it at the time. Treat the WAF as a layer that buys time, and keep the platform patched.

Turnstile is the simpler win for login, registration and checkout forms. It runs small non-interactive JavaScript challenges in the browser, so most shoppers never see a puzzle, and it works without routing your traffic through Cloudflare. The Free plan allows up to 20 widgets with unlimited challenges and 10 hostnames per widget.

Cloudflare errors 520, 521, 522, 524 and 525

The 52x errors are Cloudflare telling you it could not get a good answer from your server. The Cloudflare 5xx error guide lists them as:

Error	Cloudflare's description
520	Web server returns an unknown error
521	Web server is down
522	Connection timed out
524	A timeout occurred
525	SSL handshake failed

Cloudflare's advice is to start with your hosting provider or site administrator, and to give them the error code, the time and time zone, and the URL. The cause is often not in the origin server's own error log, so also check any load balancer, cache, proxy or firewall between Cloudflare and the origin.

Should your store use Cloudflare?

Shopify: you already get Cloudflare through Shopify's partnership. Add your own zone with O2O only if you need your own rules or Workers in front of the store.
WooCommerce and WordPress: yes, for DNS, the CDN, DDoS protection and Turnstile on forms. Add Cache Rules or APO only with cart, checkout and account paths excluded.
Magento and Adobe Commerce: yes, as a CDN and WAF layer, but never as a replacement for applying Adobe's security patches.

Measure before and after. Use Observatory or Google's Core Web Vitals data, not the Cloudflare speed test, to judge whether a change made your store faster. Our mobile PageSpeed guide covers the front-end side, and our Shopify speed optimisation team can audit caching and performance for you.