Cloudflare: Content Delivery and Security

Cloudflare Overview

• Cloudflare acts as an intermediary/proxy between a client and a server, caching static content, lowering the number of requests to the server, and allowing visitors to access the site.
• Cloudflare is a global network designed to make everything connected to the Internet secure, private, fast, and reliable.

Advantages of Cloudflare

• Site Performance Improvement: Cloudflare has proxy servers located throughout the world, which means visitors will likely see page load speed improvements as the cached content is delivered from the closest caching box.
• Alerting Visitors of Infected Computers: Cloudflare alerts human visitors that have an infected computer that they need to take action to clean up the malware or virus on their machine.
• Spam Comments Protection: Cloudflare leverages data from third-party resources to reduce the number of spam comments on the site.
• Offline Browsing Mode: In the event that the server is unavailable, visitors can still access the site since Cloudflare serves the visitor a page from its cache.
• New Site Stats: Cloudflare provides good tools to evaluate human traffic coming to the site.

Adding a Site to Cloudflare

• Step 1: Add site in Cloudflare
  • Log in to the Cloudflare dashboard
  • Click Add site and enter the website's root domain
  • Update all necessary DNS records to enable Cloudflare for the domain
  • Check nameservers
  • Click Finish when done with the Quick Start Guide
• Step 2: Update nameservers
  • Update nameservers at the registrar to Cloudflare's assigned authoritative nameservers
  • Wait 24 hours for the registrar to update the nameservers
  • Receive an email when the site is active on Cloudflare

Purging Cache

• Purge cached resources by single-file, all cached content, or other options
• Purge by single-file (by URL)
  • Log in to the Cloudflare dashboard and select the account and domain
  • Select Caching > Configuration
  • Under Purge Cache, select Custom Purge
  • Enter the appropriate value(s) in the text field using the format shown in the example
  • Perform any additional instructions to complete the form
  • Review entries and select Purge
• Purge everything
  • Log in to the Cloudflare dashboard and select the account and domain
  • Select Caching > Configuration
  • Under Purge Cache, select Purge Everything
  • A warning window appears
  • Select Purge Everything if agreed

SSL/TLS Encryption Modes

• Available encryption modes:
  • Off (no encryption)
  • Flexible
  • Full
  • Full (strict)
  • Strict (SSL-Only Origin Pull)
• Off mode: redirects any HTTPS request to plaintext HTTP, leaving visitors and the application vulnerable to attacks, and marking the site as “not secure” in Chrome and other browsers
• Flexible mode: makes the site partially secure, allowing HTTPS connections between the visitor and Cloudflare, but making connections to the origin through HTTP
• Full mode: allows HTTPS connections between the visitor and Cloudflare, and makes connections to the origin using the scheme requested by the visitor
• Full (strict) mode: enforces more stringent requirements for origin certificates, and presents the same limitations as Full mode
• Strict (SSL-Only Origin Pull) mode: connections to the origin are always made using SSL/TLS, regardless of the scheme requested by the visitor, and presents the same limitations as Full (strict) mode

Troubleshooting Cloudflare Errors

• Error 502 bad gateway or error 504 gateway timeout
  • Cloudflare returns an error when the origin web server responds with a standard HTTP 502 bad gateway or 504 gateway timeout error
  • Resolution: contact the hosting provider to troubleshoot common causes at the origin web server
• Error 520: web server returns an unknown error
  • Error 520 occurs when the origin server returns an empty, unknown, or unexpected response to Cloudflare
  • Resolution: contact the hosting provider or site administrator to review origin web server error logs for crashes and to check for common causes
• Error 521: web server is down
  • Error 521 occurs when the origin web server refuses connections from Cloudflare
  • Resolution: ensure the origin web server is responsive, review origin web server error logs to identify web server application crashes or outages, and confirm Cloudflare IP addresses are not blocked or rate-limited
• Error 524: a timeout occurred
  • Error 524 indicates that Cloudflare successfully connected to the origin web server, but the origin did not provide an HTTP response before the default 100-second connection timed out
  • Resolution: contact the hosting provider to exclude common causes at the origin web server
• Error 525: SSL handshake failed
  • Error 525 occurs when the SSL handshake between Cloudflare and the origin web server fails
  • Resolution: contact the hosting provider to exclude common causes at the origin web server, such as no valid SSL certificate installed or port 443 (or other custom secure port) not being open

Limitations of Cloudflare

• Cloudflare may affect internal statistic programs that read directly from Apache logs
• Cloudflare caches static content from the site, which may cause a delay before changes appear; Development Mode can be used to bypass this limitation

Learn about Cloudflare's role as a proxy between clients and servers, its caching of static content, and its advantages in providing security, privacy, and reliability. Understand how Cloudflare works and its benefits.