Almost everything I run goes through Cloudflare in some form. DNS, proxying, SSL, DDoS protection, tunnels — it's become the default layer between the internet and anything I host. Here's why.
The free tier is genuinely absurd
Cloudflare's free plan includes DDoS protection, a global CDN, SSL certificates, DNS management, and analytics. That's a list of things that would cost serious money elsewhere. For someone running personal projects and small hosting infrastructure, getting all of that for free is one of those things that still seems too good to be true even after years of using it.
DNS that actually works
Before Cloudflare I used whatever DNS my registrar offered. The difference in speed and reliability when you switch is immediately noticeable. Cloudflare's DNS propagates fast, the interface is clean, and having everything in one place — DNS, proxying, SSL, rules — means you're not juggling multiple dashboards to manage a domain.
The orange cloud matters
When you proxy a record through Cloudflare (the orange cloud in the DNS settings), your actual server IP is hidden. Visitors connect to Cloudflare's network, which then forwards the request to you. This means your home IP or VPS IP isn't publicly exposed for most services, which is a meaningful security improvement with zero effort required.
Cloudflare Tunnels
Tunnels are one of the most useful things Cloudflare offers. They let you expose a local service to the internet without opening any ports on your router or firewall — the tunnel connects outbound to Cloudflare's network and traffic comes back through it. No port forwarding, no exposed IP, no firewall rules. It just works, and it's free.
For things running on my home network that I want to access remotely, tunnels are the answer. You install the cloudflared daemon, point it at your local service, and it appears on a subdomain of your choice. The whole setup takes about ten minutes.
Page rules and transform rules
Cloudflare lets you add rules that modify how traffic is handled before it reaches your server — redirects, header modifications, cache rules, origin port overrides. This blog runs on a non-standard port, and a Cloudflare origin rule rewrites the destination port transparently so visitors just see a normal HTTPS URL. Stuff like that used to require nginx config changes; now it's a few clicks in a dashboard.