DNS, CDN & SSL Modes

What Cloudflare Is

A global edge network providing CDN, DNS, DDoS protection, and increasingly a full application platform (Workers, R2, D1, KV). Traffic routes through Cloudflare's edge before reaching the origin — started as CDN/security, expanded into edge compute.

Zones & Proxy Mode

A zone is a domain (+ subdomains) managed in a Cloudflare account, with its own DNS/security/caching config. The orange cloud (proxied) routes traffic through Cloudflare's edge, enabling caching/DDoS protection; grey cloud (DNS only) resolves straight to the origin IP — needed for non-HTTP protocols like SSH.

SSL/TLS Modes

Flexible — encrypts only user↔Cloudflare, NOT Cloudflare↔origin (discouraged for anything sensitive). Full — encrypts both legs but doesn't validate the origin's cert (accepts self-signed). Full (Strict) — encrypts both legs AND validates the origin's cert for genuine end-to-end assurance.

Page Rules & Caching

URL-pattern-based rules — force HTTPS, set custom cache TTL per path, redirect specific URLs — without touching application code. "Always Online" serves a cached page from the edge if the origin becomes unreachable, keeping the site partially available during an outage.

Security: WAF & Bot Management

The WAF inspects incoming HTTP traffic at the edge for known attack patterns (SQLi, XSS), blocking malicious requests before they reach the origin. Bot Fight Mode / Bot Management detects and mitigates scrapers and credential-stuffing bots while allowing legitimate crawlers.