Every Cloudflare setting explained

The Cloudflare CDN page in your portal (under your hosting service, look for Manage CDN) controls how Cloudflare handles your domain's traffic before it reaches your server. Most of the toggles are safe to leave on their defaults. This is a settings-by-setting reference so you know what each one does before you flip it.

If you just want faster pages and don't want to think about it: leave Auto Minify, Brotli, and caching on, keep SSL/TLS mode on Full (strict), and turn on Always Use HTTPS. That combination covers the vast majority of sites. Read on for what each setting actually changes.

Speed settings

Auto Minify strips unnecessary whitespace, comments, and line breaks from your HTML, CSS, and JS files as they're served, shrinking the file without changing what it does. It's safe to leave on for all three file types. Occasionally a JS minifier trips over unusual code and breaks a script; if something stops working right after enabling it, turn off Auto Minify for JS first to see if that's the cause.

Brotli is a compression algorithm, an alternative to gzip that generally compresses text-based assets (HTML, CSS, JS) smaller for the same content. Every modern browser supports it, and Cloudflare falls back to gzip automatically for the rare client that doesn't. There's no real downside to leaving it on.

Rocket Loader (beta) defers the loading of JavaScript so your page can render before all your scripts finish downloading, which can improve perceived load time. It works by rewriting how scripts are loaded on the fly, and that rewriting occasionally conflicts with scripts that expect to run in a specific order, particularly some analytics tags, chat widgets, or anything doing DOM manipulation on page load. If you turn it on and notice a widget stops initializing or a form stops submitting, turn it back off. It's still labeled beta for a reason.

Always Online serves a cached, static version of your page from Cloudflare's archive if your actual server is down or unreachable, instead of showing visitors an error. It's a fallback, not a live mirror, so anything dynamic (login, checkout, forms) won't work on the cached version, but static content stays visible during an outage. Worth leaving on if your site is mostly content.

Email obfuscation scrambles email addresses in your page's HTML so scrapers that harvest addresses off web pages for spam lists can't read them directly, then unscrambles them client-side for real visitors. It's a minor spam-reduction measure with no visible effect on the page.

SSL/TLS settings

The SSL/TLS mode controls how Cloudflare encrypts the hop between itself and your origin server, separate from the certificate that encrypts the hop between the visitor and Cloudflare. Four modes:

• Off serves your site over plain HTTP with no encryption anywhere. Don't use this.
• Flexible encrypts visitor-to-Cloudflare but sends Cloudflare-to-origin over plain HTTP. Only relevant if your origin has no certificate at all, which shouldn't be the case on Flashcloud since certificates are auto-issued.
• Full encrypts both hops, but doesn't verify that your origin's certificate is valid or trusted, it just checks that something is there.
• Full (strict) encrypts both hops and validates that your origin's certificate is properly signed and not expired. This is the correct mode for a Flashcloud-hosted domain, since we auto-issue and auto-renew a valid Let's Encrypt certificate on your origin. See SSL certificates for how that issuance and renewal works.

If you're getting a redirect loop after adding your domain, it's almost always this setting on Flexible while your origin is already serving HTTPS, Cloudflare and your origin end up disagreeing about which protocol to use. Switch to Full (strict).

Minimum TLS version sets the oldest TLS protocol version Cloudflare will accept from visitors. Setting it too high (say, TLS 1.3 only) can lock out a small number of very old browsers or devices; TLS 1.2 is the safe default for compatibility while still being modern. TLS 1.3 as a standalone toggle enables support for the newest protocol version in addition to whatever your minimum allows, it's additive and safe to leave on.

Always Use HTTPS redirects any plain HTTP request to HTTPS automatically, so visitors never land on an unencrypted page even if they typed or linked to the http:// version. Combined with the auto-issued certificate, this is what gets you the padlock with zero manual redirect configuration. Automatic HTTPS Rewrites is a related but different setting: it scans your page's HTML for hardcoded http:// links to your own domain (in image tags, scripts, stylesheets) and rewrites them to https:// before serving, catching mixed-content warnings caused by old links in your own code.

Opportunistic Encryption lets browsers that support it upgrade certain HTTP requests to use HTTP/2 over TLS without a full redirect, mainly a performance nicety for supporting browsers. It has no effect on browsers that don't support it and no downside to leaving on.

Security settings

The security level setting (from Essentially Off up to I'm Under Attack) determines how aggressively Cloudflare challenges visitors who look suspicious, based on IP reputation and request patterns. Medium is the reasonable default for most sites. Set it too high and you risk challenging legitimate visitors on shared or VPN IPs; use the highest setting only while you're actively dealing with a flood of malicious traffic, since it puts every visitor through a JavaScript challenge before they reach your site, which adds friction for real users too.

Browser Integrity Check looks at request headers for signs of a request not coming from a real browser (missing or malformed headers that bots and basic scripts often skip), and challenges anything that looks off. It runs quietly in the background and rarely affects real visitors.

The CDN page's own Hotlink Protection toggle works the same way as cPanel's version, blocking image requests whose referrer isn't your domain, but it operates at Cloudflare's edge rather than on your server, so blocked requests never even reach your hosting. If you're dealing with another site embedding your images directly, see Stopping other sites from hotlinking your images for how the referrer check works and what it does and doesn't catch.

When to contact support

If you're not sure which SSL/TLS mode matches your setup, or a Speed toggle broke something and turning it back off didn't fix it right away (changes can take a minute to propagate at the edge), open a ticket from Support in the portal. Live chat works too for a quick sanity check on a setting before you change it.