Cloudflare: From Zero to Deep End — The Complete Guide

True story.

Two years ago, I first used Cloudflare to change some DNS records. “Cool, it’s free, and the UI is clean,” I thought.

Then I discovered Pages.

Then I discovered Workers.

Then I discovered R2, KV, D1, Durable Objects, Zero Trust, Turnstile, Email Routing…

Now my entire digital life — personal website, company site, domain email, API services, databases, image hosting, file storage, VPN replacement — runs on Cloudflare.

This article is my complete retrospective, from a beginner who just “changed DNS and left” to someone who moved their entire infrastructure over. From zero to the deep end. All of it.

Level 1: DNS — Where It All Begins

For 90% of people, Cloudflare starts with DNS. Register an account, point your nameservers to Cloudflare, done.

But a few things you might have missed:

The Orange Cloud vs. The Gray Cloud

Click the cloud icon next to any DNS record:

Orange (Proxied): Traffic flows through Cloudflare → you get CDN acceleration + DDoS protection + SSL + WAF, but Cloudflare knows your origin IP.
Gray (DNS Only): Cloudflare only resolves DNS, traffic goes directly to your server.

For most use cases, orange is the right choice. Turn it off if you’re running something that doesn’t support reverse proxying (like certain P2P nodes).

Enable DNSSEC

At the bottom of the DNS settings page, there’s a DNSSEC option. Enable it, and no one can hijack your domain resolution. Setup requires adding a DS record at your domain registrar — Cloudflare gives you the exact values, just copy and paste.

Leave TTL on Auto

Cloudflare’s DNS is global Anycast, with TTL defaulting to Auto (300 seconds). You don’t need to manually adjust this unless you have specific failover requirements.

Level 2: CDN & Caching — The Freebie Era

Once your DNS goes orange, your site is already wrapped in Cloudflare’s CDN. 300+ cities worldwide, auto-caching static assets.

But you need to know how to configure it.

Cache Rules

By default, Cloudflare only caches static files like JS/CSS/images. If you want to cache HTML pages, API responses, or define custom caching behavior, go to Caching → Cache Rules.

For example, if your blog pages update infrequently, add a rule:

Match URL Path: /blog/*
Edge TTL: 1 hour
Browser TTL: 10 minutes

Now visitors worldwide get your pages from the nearest edge node instead of hitting your origin every time.

Polish (Image Optimization)

Not available on the free plan — Pro ($25/mo) and above. Automatic WebP conversion, image compression, responsive sizing. If your site is image-heavy, this alone is worth the subscription.

Workers Replace Page Rules

Veterans might remember Page Rules — that simple but powerful rule system. Cloudflare has since split it into Cache Rules, Redirect Rules, Configuration Rules, and more granular modules. The old Page Rules still work but are no longer recommended — the new modules are far more flexible.

Level 3: Security — More Free Stuff Than You’d Expect

SSL/TLS — One-Click HTTPS

Go to SSL/TLS settings and change the mode from Flexible to Full (Strict).

What does each mode mean?

Flexible: Browser → Cloudflare is encrypted, but Cloudflare → your server is plaintext. Half-baked security. Not recommended.
Full: Both legs encrypted, but certificates aren’t verified. Theoretical MITM risk.
Full (Strict): Both legs encrypted + certificate verification. You need a certificate on your origin (Cloudflare’s Origin CA issues free ones with 15-year validity). This is the correct answer.

If you’re using Cloudflare Pages, all of this is handled automatically.

WAF (Web Application Firewall)

The free plan includes basic rules that block common SQL injection, XSS, and other attacks. Go to Security → WAF and enable:

Managed Rules: Cloudflare-maintained rulesets — the free tier includes the Cloudflare Managed Ruleset.
Custom Rules: e.g., “If request is from country X AND URL contains /admin, block.”

Bot Fight Mode

A free feature that automatically blocks known malicious crawlers and scanners. But it occasionally false-positives legitimate bots (like Googlebot). If your SEO ranking drops, check here first.

Rate Limiting

The free plan supports basic rate limiting. For example, “Same IP hitting /login: max 10 requests per minute.” Essential for brute-force protection.

DDoS Protection

Automatically enabled — you don’t configure anything. This is Cloudflare’s crown jewel: the world’s largest network-layer DDoS protection, at no extra cost.

I once got hit by a small-scale DDoS (likely a competitor scanning ports). Cloudflare absorbed it without me even noticing. I only found out afterward when checking Analytics — 400K requests blocked overnight.

Level 4: Pages — Your First Serverless Website

By now, you’re no longer satisfied with “just DNS and caching.” You want to host your website on Cloudflare too.

Cloudflare Pages is the answer.

It’s a static site hosting platform, similar to Vercel / Netlify, but:

Unlimited bandwidth, unlimited requests (free!)
Global CDN built in
Automatic HTTPS
Custom domain support
Git push to deploy

How to use it?

Push your site code to GitHub
Connect Cloudflare Pages to your repo
Set the build command (e.g., npm run build) and output directory (e.g., dist)
Every push to main triggers an automatic build and deploy

That simple.

Pages Functions

If your site needs backend logic, Pages has built-in Functions — essentially Workers, but integrated into your static site deployment pipeline. Create a functions/ directory in your project root, drop in TypeScript/JavaScript files, and each file becomes an API endpoint:

functions/
  api/
    webhook.ts    →  /api/webhook
    auth.ts       →  /api/auth

The file path IS the URL path. Zero configuration.

I deployed two sites on Pages — jask.dev and uzenlabs.com. Git push to live in about 30 seconds. Never worry about servers, certificates, or CDN configuration again.

Level 5: Workers — True Edge Computing

If Pages is “hosting static websites,” Workers is “running your code on Cloudflare’s edge nodes.”

Your code doesn’t run in a single data center — it’s deployed across 300+ cities worldwide. A user in Tokyo? Your code runs in Tokyo. A user in New York? It runs in New York. Ultra-low latency.

What does a Worker look like?

export default {
  async fetch(request: Request, env: Env): Promise<Response> {
    const url = new URL(request.url);
    
    if (url.pathname === "/api/time") {
      return Response.json({
        time: new Date().toISOString(),
        region: request.cf?.colo || "unknown",
      });
    }
    
    return new Response("Hello from the edge!");
  },
};

Just a few lines. Deploy it, and it’s globally available.

What can you do with it?

I’ve used Workers for:

API aggregation layer: Combine multiple third-party APIs into a unified response, frontend calls one endpoint
Auth middleware: JWT verification + route-level permission control
Webhook handling: Receive GitHub/Telegram webhooks, process data, forward
URL shortener: A KV lookup + redirect, 50 lines of code
CORS proxy: Bypass browser cross-origin restrictions
Scheduled tasks (Cron Triggers): Daily data scraping, notifications

Pricing

Free plan: 100,000 requests/day, 10ms CPU time per request. More than enough for personal projects.

Paid plan ($5/mo): 10 million requests, 30 seconds CPU time per request. The moment you upgrade, you’ll wonder why you ever spent money on VPS.

Developer Experience

npm create cloudflare@latest my-worker
cd my-worker
npx wrangler dev    # Local development
npx wrangler deploy # Deploy

wrangler is Cloudflare’s CLI tool. The experience is similar to Vercel CLI but more fully featured. Local dev, hot reload, log viewing, secrets management — all in one command.

Level 6: The Storage Suite — R2 / KV / D1 / Durable Objects

Once you start writing backend logic on Workers, you need storage. Cloudflare prepared a full suite:

R2 — Object Storage (S3-Compatible)

Same API as AWS S3, but zero egress fees. This is the killer feature.

Store 100GB on S3, download it once, and you pay $9 in egress. On R2, download it 10,000 times — $0 egress.

Pricing: Storage $0.015/GB/month, Class A operations $4.50/million, Class B operations $0.36/million, egress free.

Free tier: 10GB storage + 1 million Class A ops + 10 million Class B ops per month.

Usage:

// Operating R2 from a Worker
const bucket = env.MY_BUCKET;
await bucket.put("file.txt", "Hello R2!");
const obj = await bucket.get("file.txt");
const text = await obj.text();

Also operable via wrangler CLI:

npx wrangler r2 object put my-bucket/avatar.png --file=./avatar.png

R2 also supports custom domains and public access — use it as an image host.

KV — Key-Value Storage

Extremely fast reads (cached at edge globally), ideal for data that rarely changes. Eventually consistent — not suitable for scenarios requiring strong consistency.

Use cases: Configuration, URL shortener mappings, user sessions, cache layers.

await env.MY_KV.put("user:123", JSON.stringify({ name: "Jask" }));
const user = await env.MY_KV.get("user:123", "json");

Pricing: Free tier includes 1GB storage + 100K reads/day. Paid reads at $0.50/million — very cheap.

D1 — SQLite Database

Cloudflare’s SQLite database, running at the edge. Full SQL support — JOINs, transactions, foreign keys, all included.

If you need relational data and complex queries, use D1.

const { results } = await env.DB.prepare(
  "SELECT * FROM posts WHERE author = ? ORDER BY created_at DESC LIMIT 10"
).bind("jask").all();

Pricing: Free tier includes 5GB storage + 5 million row reads/day. Plenty for small to medium apps.

Durable Objects — Stateful Edge Computing

The most hardcore one. Workers are stateless by default, but Durable Objects give you a stateful, single-threaded, strongly consistent runtime. Use cases: real-time collaboration, chat rooms, WebSocket connections, rate limit counters.

This is advanced — beginners can skip it. Come back when you genuinely need a “globally unique stateful instance.”

Level 7: Zero Trust — Your Personal VPN Replacement

Many people don’t know about this feature, but once they try it, there’s no going back.

Cloudflare Zero Trust (50 free user seats) lets you:

1. Securely Access Internal Services

Got a home NAS or an admin panel you don’t want exposed to the public internet? You used to need a VPN. Now:

Install the Cloudflare WARP client
Configure an Access Policy in the Zero Trust dashboard (e.g., “Only my email can access nas.example.com”)
When accessing nas.example.com, Cloudflare shows a login page — verify, and you’re in

No ports to open. No VPN server to maintain.

2. WARP Client — More Secure Than a Commercial VPN

WARP isn’t a traditional VPN — its design goals differ:

It doesn’t hide your IP (it won’t help you bypass geo-restrictions)
It encrypts your DNS queries and traffic (prevents ISP hijacking/snooping)
It can pair with Gateway for DNS filtering (block malicious domains, ads, etc.)

Once WARP is on, your ISP can’t see what websites you visit.

3. Tunnel — Reverse Proxy, Perfected

cloudflared tunnel lets you expose local services to the internet without opening any inbound ports.

# Install cloudflared
brew install cloudflared

# Create a tunnel
cloudflared tunnel create my-tunnel

# Route local port 8080 to dashboard.example.com
cloudflared tunnel route dns my-tunnel dashboard.example.com

# Run
cloudflared tunnel run --url http://localhost:8080 my-tunnel

Your server has zero open ports. Cloudflare initiates the connection outbound and pulls traffic through. Far more secure than ngrok, and it’s free.

Level 8: Hidden Gems You Might Have Missed

Email Routing

Cloudflare can handle email forwarding for your domain for free. hi@yourdomain.com auto-forwards to your Gmail. No need to buy email hosting, no MX record configuration — done in seconds.

Turnstile

The reCAPTCHA alternative. No more clicking traffic lights and fire trucks — verification happens silently in the background. Much better UX. Free, unlimited usage.

Images

Image hosting service. $5/month, includes 100GB storage and unlimited bandwidth. Automatic resizing and format conversion. Cheaper than Cloudinary.

Stream

Video hosting + transcoding + player. Pay per use, no YouTube ads or recommendations. Great for paid courses and product demos.

WARP + Gateway

DNS-level ad blocking and malicious site protection. Configure policies in Gateway, auto-applied on WARP clients. Every app on your device is protected, not just your browser.

Zaraz

Third-party script manager. A Google Tag Manager alternative, but executes on Cloudflare’s edge — much faster than GTM.

Browser Rendering

Run headless browsers inside Workers. Scraping, screenshots, PDF generation. Way cheaper than running your own Puppeteer cluster.

Level 9: AI & MCP — The Future Is Already at the Edge

If you think the above is already a lot, hold on. Cloudflare has gone deep on AI, and the barrier to entry is incredibly low.

Workers AI — Run LLMs at the Edge

No GPU to buy, no PyTorch to configure, no inference server to deploy. Call a large language model with a single line of code in your Worker:

const response = await env.AI.run("@cf/meta/llama-3.1-8b-instruct", {
  messages: [{ role: "user", content: "Explain what a CDN is in one sentence." }],
});

Models run on Cloudflare’s GPU nodes, with requests automatically routed to the nearest one. Supports open-source models like Llama, Mistral, and Qwen, plus smaller models for image generation, speech recognition, and translation.

Free tier: 10,000 neuron predictions per day. Personal projects can go wild.

Remote MCP Server — An Industry First

MCP (Model Context Protocol) is an open protocol introduced by Anthropic that lets AI assistants connect to external tools and data. Previously, MCP Servers could only run locally — Cloudflare is the first platform to support remote MCP Servers.

What does this mean? Your AI client (Claude, ChatGPT, etc.) can connect directly via URL to an MCP Server you deployed on Workers. No local installation required.

Deploying an MCP Server takes just:

npx create-cloudflare@latest my-mcp-server
# Select the "Remote MCP Server" template
cd my-mcp-server
npx wrangler deploy

30 seconds, and your MCP Server is live — with authentication and global edge acceleration built in.

Paste the URL into Claude Desktop / Cursor / AI Playground, and you’re good to go. So much simpler than traditional local MCP — no environment setup, no port management, no manual process starting.

Code Mode — One MCP, Entire Cloudflare API

This is the coolest part. Cloudflare released an MCP Server that exposes the entire Cloudflare API using just two tools: search() and execute() — from DNS to Workers to R2 to Zero Trust.

Your AI assistant can directly manage your Cloudflare resources. Tell Claude “add a CNAME record for jask.dev,” and it actually does it. The entire MCP consumes only about 1,000 tokens of context — insanely efficient.

Getting Started Resources

Want to try it out? Bookmark these:

Remote MCP Server Docs — Complete guide to deploying your own MCP Server
Code Mode Blog Post — The design philosophy behind search() + execute()
Workers AI Docs — Supported models and API usage
AI Playground — Try it online, no code needed
Cloudflare Agents SDK — Full framework for building AI Agents — MCP + Durable Objects + Workflows

Honestly, I’ve tried many platforms for AI Agent development, and Cloudflare’s developer experience is among the best. Clear docs, ready-made templates, generous free tier — going from zero to a working AI tool might take 30 minutes.

”The Deep End”: When Cloudflare Becomes Your Infrastructure

At this point you might ask: Isn’t there vendor lock-in risk if I move everything to Cloudflare?

Honestly, yes.

R2 is S3-compatible API-wise, but Workers’ runtime, KV’s data model, D1’s SQL dialect — these are Cloudflare-specific. Once you architect your entire system on top, migration costs are high.

But I still went all-in. The reason is simple:

It’s just too good.

Free tiers that are almost impossible to exhaust for individual developers
A global edge network that makes your services low-latency by default
One account managing DNS + CDN + Security + Compute + Storage + Email — replacing at least 5 platform subscriptions
High-quality docs, consistent API design, unified developer experience
Fast feature iteration — new stuff almost every month

But here are the pitfalls you should know:

Workers CPU time is “execution time,” not “wall clock time” — If you await fetch() and wait 2 seconds, that doesn’t count as CPU time. But if your code does heavy computation, the free plan’s 10ms limit will get you.
KV is eventually consistent — After writing a key, global propagation can take tens of seconds to minutes. Don’t use KV for scenarios requiring strong consistency (like payments).
D1 is still in Beta — Performance and stability are continuously improving, but don’t run your core transactional system on it yet.
China access speed is inconsistent — Cloudflare has no edge nodes in mainland China (unless you buy Enterprise + ICP filing). If your users are primarily in China, latency may be higher than Alibaba/Tencent Cloud CDN.
Don’t put all eggs in one basket — Cloudflare itself has had global outages before. Have backups and fallback plans for critical services.

Finally

I started using Cloudflare in 2024 — from changing a DNS record to now running Workers + R2 + KV + D1 + Pages + Zero Trust + Tunnel. I’ve hit my share of pitfalls, but I’ve also saved a massive amount on server costs and ops time.

This article can’t replace the official docs — Cloudflare’s documentation is excellent, and you should consult it for specific problems. But this gives you a map of what the platform can do, which features are worth learning, and which you can skip for now.

From DNS to edge computing, this is the full appeal of Cloudflare.

If you’re using Cloudflare, or thinking about getting started, I’d love to hear how you use it. This platform’s depth is far beyond what most people imagine.

And for me, “the deep end” isn’t a bad thing — it’s because once you’re in, you never want to climb out.