In other posts I give my point of view on the security advantages of using Cloudflare. But what’s to stop a bad guy, gal, or bot from accessing my site directly by IP address? I can try to keep my IP address secret, but a determined hacker will find it without too much trouble. He or she or his/her robot minions could then avoid Cloudflare security by attacking my site directly – unless I take explicit measures by allowing only Cloudflare traffic.
Rambling thoughts about WordPress
Cloudflare
Rocket Loader rocks! (finally)
Since 2011 Cloudflare, even on their free tier, has offered a very promising, very frustrating feature called Rocket Loader. Rocket Loader promises to greatly accelerate the loading of JavaScript, turbocharging JavaScript-heavy sites like those that use WP.
Read more Rocket Loader rocks! (finally)
Web Cache Deception Hacks
Web cache deception hacks are a fairly recent threat, first described by Omer Gil in February 2017. In certain situations a hacker could leverage a misconfiguration between a web server and a proxy cache like Cloudflare to reveal sensitive information that could help the hacker takeover my account. To be honest, this seems like a very unlikely threat. The situations that could cause it seem complex and obscure, and large scale attacks of this sort have not been observed in the wild.
Cloudflare Speed Settings
In another post I cover a Cloudflare page rule for blazing site speed. This post discusses miscellaneous Cloudflare speed settings. Cloudflare, even at the free tier, offers a plethora of speed and security settings that seem daunting at first. Most of them work fine using the default setting, and I can adjust settings at my own pace as I am able to make time to learn and optimize.
Cloudflare Security Settings
In another post I cover Cloudflare page rules for login security. This post discusses miscellaneous Cloudflare security settings. Cloudflare, even at the free tier, offers a plethora of speed and security settings that seem daunting at first. Most of them work fine using the default setting, and I can adjust settings at my own pace as I am able to make time to learn and optimize.
Caching Plugin
I chose my web host carefully. My sites are hosted on a LiteSpeed web server, so I am able to use the remarkable free LiteSpeed Cache (LSC) plugin. LSC provides much more than just lightning-fast server-side caching. In also includes a suite of optimization tools such as: Database optimization; Image optimization – which seems to be equal to or better than the paid/premium versions of competing plugins; Connection to Cloudflare so I can put CF in development mode or purge the CF cache; and Miscellaneous settings like ‘Remove query strings from static resources’.
Using my two favorite website speed checkers, WebPageTest.org and GiftOfSpeed.com …
Cloudflare page rule for blazing site speed
Cloudflare, even the free tier, improves my site speed and security – so much so that I use it for all my sites. The default settings boost site speed by global distributed caching of static content. Static content, by Cloudflare’s definition, excludes HTML. This makes sense for dynamic sites with frequent new posts and user comments. For my sites like this one, that have less frequent new posts and do not allow user comments or other dynamic content, I can dramatically increase site speed using a page rule.
Cloudflare page rules for login security
Cloudflare page rules deserve to be much more widely known and used as a highly effective component of a layered brute force login defense. The Cloudflare free tier gives me three page rules, which is enough – just barely – for both login security and blazing site speed. Login security takes up two of the three rules, but does double duty by also bypassing the Cloudflare cache for the admin area. My Cloudflare page rules for login security block bad bots at the Cloudflare level, so they never even get to my site’s server, login screen, or admin area. A storm of brute force login bots – even if unsuccessful at logging in – could slow my site or bring down my site by tying up resources. These rules move all that resource burden off my site and onto Cloudflare.
