What is Cloudflare, and does your business website actually need it?
Cloudflare is the layer that sits between your visitors and the server your website lives on. Every request goes to Cloudflare first, which decides whether to answer it from a cached copy, pass it through to your server, or block it. That single design choice explains almost everything else about it: the speed, the attack filtering, the free plan, and the specific ways it breaks a site when it is set up in the wrong order.
This page is written for the person deciding whether to turn it on, not for the person configuring it. If you have already decided and want the steps, go to setting up Cloudflare on an Australian domain instead.
What it actually is, without the marketing
Three separate products get sold as one word, and confusing them is why people argue past each other about whether Cloudflare is worth it.
| The part | What it does | Do you get it free? |
|---|---|---|
| Authoritative DNS | Holds your DNS records and answers the question "where does this domain point?". Replaces the DNS your registrar or host provides. | Yes |
| The proxy and CDN | Traffic passes through Cloudflare's network, which caches copies of your files close to visitors and hides your server's real IP address. | Yes, per record |
| The security layer | Filters attacks before they reach your server, including unmetered DDoS protection and a free managed firewall ruleset. | Yes, the free tier of it |
You can use the first without the second. Plenty of businesses host their DNS at Cloudflare purely because it is fast and free to edit, and leave every record set to DNS only, so no traffic is proxied at all. That is a legitimate configuration and it is the safest starting point for a site that already works.
What the free plan actually includes
The Free plan is genuinely $0 per month, and Cloudflare describes it as being for "personal or hobby projects that aren't business-critical". Read that framing as a sales position rather than a technical limit, because the features that matter to a brochure or small ecommerce site are all on it. From Cloudflare's own plan comparison, the Free tier includes:
- Fast, easy to use DNS
- Unmetered DDoS protection
- The CDN
- A Universal SSL certificate
- The Free Managed Ruleset and the Web Application Firewall
- Single sign-on support and role based account control
Pro is listed at $20 per month billed annually, or $25 billed monthly, and adds things like lossless image optimisation. Business adds PCI DSS 4.0 compliance and a 100% uptime SLA. The honest summary for most small businesses: the paid plans do not buy you a faster or safer version of the basics, they buy additional features you probably have not asked for yet. Start free, and upgrade when something specific forces it.
The four jobs businesses genuinely hire it for
1. DNS that is quick to change and hard to lose
This is the most common real reason, and the least discussed. Registrar DNS panels are frequently slow, ugly, and occasionally lose records. Cloudflare's is fast, shows the whole zone on one screen, and keeps a change history. If you manage more than one domain, this alone justifies it.
2. Absorbing attacks you would otherwise pay for
Unmetered DDoS protection on the free plan means a volumetric attack hits Cloudflare rather than your hosting bill. For a small business on shared or VPS hosting, an attack that would otherwise mean a suspended account or an overage invoice becomes a non-event.
3. Hiding your origin server
When a record is proxied, visitors see a Cloudflare IP address rather than your server's. Attackers cannot target what they cannot find. This matters more than speed for most small sites, and it is the benefit people most often fail to notice they are getting.
4. Caching for a geographically spread audience
If your customers are overseas and your server is in Sydney, caching genuinely helps. If your customers are in Western Sydney and your server is in Sydney, the honest gain is small. Do not let anyone sell you a CDN as a fix for a slow website when the cause is a 4 MB hero image.
When you genuinely do not need it
Every guide on this topic is written by someone with a reason to say yes. Here are the cases where the answer is no, or not yet.
- Your site is behind a platform that already does this. Shopify, Squarespace, Wix and similar platforms already run their own CDN and DDoS protection. Adding Cloudflare in front usually means fighting two caching layers, and on some platforms it is explicitly unsupported.
- Your host already includes it. Many Australian hosts resell Cloudflare or run an equivalent. Check before you add a second layer to the same site.
- You cannot safely move your DNS right now. A full setup replaces your entire DNS zone, which is how businesses lose their email. If nobody can tell you with confidence what MX and TXT records the domain currently carries, fix that first and add Cloudflare afterwards.
- The site is slow for reasons Cloudflare cannot touch. Unoptimised images, a bloated page builder, a struggling database. Caching hides some of it from repeat visitors and none of it from Google's field data. Fix the cause, then add the cache.
Putting Cloudflare in front of your site adds a dependency. When it fails, your site fails with it, even though your server is healthy and your host has done nothing wrong.
This is not hypothetical. On 18 November 2025, Cloudflare's network began failing to route core traffic at 11:20 UTC, and visitors to customer sites saw an error page. In Cloudflare's own post mortem, it was not an attack: a change to a database system's permissions caused a bot management configuration file to double in size, past a limit in the software that reads it. Core traffic was largely normal again by 14:30 and all systems were normal at 17:06.
That is a good outage, handled well and documented honestly, and it is still several hours in which nothing you could do at your end would have brought your site back. Weigh that against the attacks it absorbs the rest of the year. For most businesses the trade is clearly worth it. It is not free of cost, and you should know what you are accepting.
The Australian specifics
You cannot register a .com.au with Cloudflare
Cloudflare Registrar sells domains at cost, with no markup on renewals, which makes it genuinely attractive. It does not sell Australian ones.
Cloudflare's documentation states it supports over 400 top-level domains and points to its TLD policies page for the full list. Checked on 15 August 2026, that page contains no entry for .au or .com.au. To be confident that was a real absence rather than a broken search, the same check found .nz present 13 times, along with .com, .org and .io, so country domains do appear on that list and Australia's simply is not among them.
What this means in practice is straightforward and much less annoying than it sounds: keep the domain registered with your Australian registrar and point its nameservers at Cloudflare. You get all of the DNS, CDN and security benefits. Only the billing relationship stays local, which is where it has to be anyway, because .au domains carry auDA eligibility requirements tied to an Australian entity. If you are choosing a registrar, see buying a domain name in Australia.
Australian email on an Australian domain
Cloudflare will happily forward email on your domain for free, which is a real option for sole traders and new businesses. It has one hard limitation that decides the question for most people, and we have written it up separately in free email on your own domain with Cloudflare Email Routing.
How to tell if a site is already on Cloudflare
One command answers it:
| Command | What the answer means |
|---|---|
dig NS example.com.au +short | Nameservers ending in ns.cloudflare.com mean the DNS is hosted at Cloudflare. |
dig A example.com.au +short | If the address returned is a Cloudflare IP rather than your server's, that record is proxied. If it is your real server IP, the record is DNS only. |
Those two answers are independent, and people conflate them constantly. A domain can be on Cloudflare's DNS with nothing proxied at all, which means you are getting the DNS benefits and none of the caching or protection. If you inherited a site and want to know what you actually have, check both.
Questions we get asked
Is Cloudflare free?
Yes. The Free plan is $0 per month and includes DNS, CDN caching, unmetered DDoS protection, a Universal SSL certificate and the free managed WAF ruleset. That is the plan most small business websites use permanently. Pro starts at $20 per month billed annually, or $25 billed monthly, and buys additional features rather than a better version of the basics.
Can I register a .com.au domain with Cloudflare?
No. As at 15 August 2026, Cloudflare's own TLD policies page lists no .au or .com.au entry, while other country domains such as .nz do appear. You can still use Cloudflare for DNS on a .com.au: the domain stays registered with your Australian registrar and you point its nameservers at Cloudflare.
Will Cloudflare make my website faster?
For visitors far from your server, usually yes. For an Australian business whose customers and server are both in Australia, the gain is much smaller. Cloudflare does not fix a slow website. If pages are slow because of oversized images, a bloated theme or a database problem, those causes are all still there afterwards. See improving PageSpeed on WordPress for the things that actually move the number.
Does Cloudflare replace my web host?
No. It sits in front of your host, and your website still lives on the origin server you already pay for. If that server goes offline, Cloudflare has nothing to serve and visitors get an error page, most often 521 or 522.
Is it safe to turn on for a live site?
Yes, if you do it in the right order. The failure mode is not Cloudflare itself, it is switching nameservers before the new zone is complete, and enabling the proxy before your server has a valid certificate. Both are avoidable and both are covered in the setup guide.
The short version
Cloudflare is a proxy, a DNS host and a security filter sold as one product, and the free plan covers what a small business website actually needs. The strongest reasons to use it are unglamorous: DNS that is quick to edit, attacks absorbed before they reach your hosting bill, and your server's address hidden from people scanning for targets. The speed benefit is real but overstated for a business whose customers and server are both in Australia.
Turn it on if your site is self-hosted, you know what is in your DNS zone, and you can follow the setup order. Leave it alone if you are on a platform that already includes a CDN, or if your DNS records are currently a mystery, because the way this goes wrong is not subtle and it usually takes the email with it. And if you are in Australia, register the domain locally and use Cloudflare for DNS only, because the registrar side is not available to you.
General guidance only, current at the review date above. Cloudflare changes its plans and product names regularly, so check its own pages before acting on any specific figure here.
Where this comes from
The primary sources behind the above, so you can check any of it yourself:
- Cloudflare plans and pricing, the source of the Free plan feature list and the Pro pricing.
- Cloudflare outage on November 18, 2025, the source of the outage timeline and cause.
- Cloudflare TLD policies and Top Level Domains supported, checked on 15 August 2026 for
.auand.com.au. - Cloudflare: proxy status, the source of the distinction between proxied and DNS-only records.