Easy Tech TutsHow to Connect WordPress to Cloudflare, Install, Setup & Use Easily 2026
By Impran M NLast checked against official docs
Cloudflare sits in front of a WordPress site and takes over jobs your host shouldn't have to handle alone: caching pages at the edge, absorbing traffic spikes, and forcing HTTPS across every page. None of that happens just because your domain resolves.
You have to add the site to a Cloudflare account, point your registrar's nameservers at it, and then bridge WordPress to that account with the official plugin and a scoped API token. This guide walks through each piece in order, including where the setup happens inside both the Cloudflare dashboard and the WordPress admin.
01Start from your Cloudflare account home
Log into Cloudflare and you land on Account home, which lists every domain already connected along with quick stats: security insights, cache rate, and web traffic for the last 24 hours. If this is your first site, that Domains panel is empty, which is your cue to add one. You'll come back to this dashboard later for DNS and caching settings once WordPress is talking to Cloudflare, so take a minute to get familiar with the sidebar layout now.
02Add your WordPress domain to Cloudflare
From Domains in the sidebar, choose to connect a domain instead of transferring or buying one. You're keeping your existing registrar, just routing DNS through Cloudflare.
Type in your WordPress site's domain and Cloudflare scans your current DNS records automatically, then offers a free plan to start on. Review the imported records before continuing. A missed record here is the most common reason a site breaks briefly during migration.
03Update your nameservers at the registrar
Cloudflare gives you two new nameservers to replace whatever your registrar currently has on file. Log into wherever you registered the domain, often a different company than your WordPress host, and paste the new nameservers into its DNS or nameserver settings.
This is the step that reroutes traffic through Cloudflare. It can take anywhere from a few minutes to 24 hours to fully propagate, so don't be alarmed if the change isn't instant.
04Generate a WordPress-scoped API token
Back in Cloudflare, open My Profile > API Tokens and select Create Token, instead of reusing your account's global API key. A scoped token limits the damage if it ever leaks.
The plugin only needs two permissions: Zone > Zone > Read, which lets it load your list of domains, and Zone > Cache Purge > Purge, which lets it clear cached pages when you publish or edit content. Cloudflare's own token templates don't currently include one built specifically for the WordPress plugin, so build a custom token with just those two permissions scoped to your zone. Copy the token immediately after generating it; Cloudflare only shows the full value once.
05Install the official plugin in WordPress
Log into your WordPress admin. It's the same dashboard whether you access it directly or through your hosting provider's own onboarding panel, since many hosts like Hostinger wrap it in their own interface.
From Plugins, search for the official Cloudflare plugin, install it, and activate it. If your host's onboarding flow is still asking you to pick a theme or finish site setup, you can safely skip past those prompts to get to the Plugins menu.
06Connect the token and apply recommended settings
Open the Cloudflare plugin's settings page inside WordPress. Activation asks for both the email address on your Cloudflare account and the API token you just generated, not the token alone, so have both ready.
Once it authenticates, the plugin exposes a button to apply Cloudflare's recommended settings for WordPress: click it to enforce strict SSL and pick up the suggested performance defaults in one pass instead of configuring each setting by hand. Automatic cache purging is included at no extra cost and isn't gated behind a paid plan; confirm it's toggled on so publishing or editing a post clears the cached version at the edge instead of leaving visitors looking at stale content.
Frequently asked questions
Do I need the official Cloudflare plugin, or can I just switch nameservers?
Switching nameservers alone routes your DNS through Cloudflare, but the plugin adds WordPress-specific integration, like automatic cache purging when you update content.
What does the recommended-settings button change?
It applies Cloudflare's suggested performance and security defaults, including enforcing strict SSL, in a single click instead of configuring each option by hand.
Will connecting Cloudflare slow down my WordPress admin dashboard?
No. Cloudflare's caching is configured to bypass the WordPress admin area, so you can still manage your site normally.
Can I use Cloudflare with WordPress without an API token?
Basic DNS-level protection works without the plugin, but WordPress-specific features like automatic cache purging need the plugin connected with an API token.
Why generate a scoped API token instead of using my global API key?
A scoped token limits what it can access, just Zone Read and Cache Purge for this plugin, so if it's ever exposed, the damage is contained instead of exposing your whole Cloudflare account.
Sources and last check
Click path and screens come from a walkthrough recorded in July 2025. The API token permission requirements (Zone Read plus Cache Purge, not the global API key) and the claim that automatic cache purging is free on every plan were checked against Cloudflare's official token documentation and the plugin's WordPress.org listing in September 2026. The guide previously described the token's permissions only vaguely as 'zone read and cache purge, typically.'
About the author
Impran M N
I've been hooked on technology for as long as I can remember — especially the new tools and AI apps that seem to land every other week. Easy Tech Tuts is where I write up whatever I've just worked out: I do the task in the real product, record the screen, and turn it into the guide I wish I'd found first.
