Cloudflare in front of your website: what our add-on does and does not do

With Cloudflare in front of your website, visitors' requests pass through Cloudflare's network before they reach your server, so floods and many common attacks are filtered out first. The Noiz Cloudflare add-on keeps your domain's DNS on Cloudflare in sync with your hosting control panel, and Noiz switches Cloudflare on and makes the basic configuration and security changes for you. Cloudflare is a strong extra layer for a website. It does not protect your email, update your plugins or back up your site, so this article sets out both sides.

What happens when Cloudflare sits in front of your website

Normally, a visitor's browser looks up your domain, gets your server's address and connects straight to it. When Cloudflare is in front of the site, the lookup returns Cloudflare's address instead. The browser connects to Cloudflare, Cloudflare checks the request, and only then passes it on to your server. Cloudflare calls this proxying.

Two things follow:

• Attacks and floods can be stopped at Cloudflare, before they use any of your server's capacity.
• The public address for your website is Cloudflare's, not your server's.

What our Cloudflare add-on includes

The add-on is available on Noiz hosting plans and Cloud servers, and you add it from the client area. It includes:

• Your DNS on Cloudflare, kept in sync. The records you edit in the Noiz control panel are copied to Cloudflare automatically, so you keep one place to manage them. Our help article on adding and editing DNS records in Plesk applies unchanged.
• Cloudflare managed by Noiz. We activate or deactivate Cloudflare for your domain and make basic configuration and security changes when you ask.
• Cloudflare's filtering when it is active. While Cloudflare is active for your domain, its network filters web traffic before it reaches your server.

The add-on is optional. Noiz's own server-side protections, including a web application firewall and rate limits on our shared hosting, apply whether or not your domain uses Cloudflare.

What Cloudflare protects against

Cloudflare documents these protections on every one of its plans:

• Denial-of-service attacks. Cloudflare's protection against floods of traffic is unmetered and unlimited, at the network level and at the level of web requests.
• Widely exploited vulnerabilities. A managed set of firewall rules blocks requests that try known, high-impact attacks, including attacks on WordPress.
• Encryption between visitors and Cloudflare, with a free certificate Cloudflare issues and renews.

Proxied or DNS-only: why some records stay visible

Only web traffic can pass through Cloudflare's proxy. Cloudflare's documentation is specific: it proxies HTTP and HTTPS, and only address records (A, AAAA and CNAME) can be proxied. Everything else is "DNS-only", which means Cloudflare answers the lookup with your server's real address:

• Email. MX records cannot be proxied, and mail (SMTP, IMAP and POP3) never passes through Cloudflare's web proxy.
• FTP and SSH, which are not web traffic.
• Verification and text records, such as SPF.

This matters for one claim people often make about Cloudflare: that it hides your server. It hides the address in your website's own records. But Cloudflare's documentation points out that a DNS-only record on the same server, such as the one for your mail, reveals it, and that a determined attacker may find the address in other ways. Cloudflare makes your server harder to find, not impossible.

What Cloudflare does not do

Cloudflare filters requests. It does not change what is on your server. So it does not:

• Protect your email. Spam filtering, and SPF, DKIM and DMARC for your domain, come from your mail service. The Email Security add-on covers those for domains hosted with Noiz.
• Update WordPress, plugins or themes. A firewall rule can block some attempts to exploit a known flaw. The flaw is still there until the plugin is updated. WordPress Care does the weekly updates and security patching.
• Remove malware or back up your site. Every Noiz shared hosting plan includes a weekly backup kept off site, and WordPress Care includes hack fix and recovery.
• Stop someone using a stolen password. A criminal signing in with a real username and password looks like a real visitor. Two-factor authentication and unique passwords protect logins; our article on infostealer malware explains how passwords get stolen.
• Catch requests sent straight to your server's address. Traffic that goes around Cloudflare does not pass its filters. On Noiz hosting, our own server-side protections still apply to it.

Encryption all the way to the server

There are two connections when Cloudflare is in front of a site: from the visitor to Cloudflare, and from Cloudflare to your server. Cloudflare's "Flexible" mode encrypts only the first, so traffic between Cloudflare and your server travels unencrypted. Cloudflare says Flexible is not suitable for sites with logins or personal information, and recommends "Full (strict)", which encrypts both connections and checks the server's certificate. Every Noiz hosting plan includes a free Let's Encrypt certificate, which is what Full (strict) needs; our help article shows how to install a free Let's Encrypt certificate in Plesk.

Things to know before switching it on

• Your nameservers move to Cloudflare. Cloudflare becomes the DNS provider for the domain.
• DNSSEC has to be handed over. If your domain uses DNSSEC, it must be switched off at the registrar before the nameservers change and set up again with Cloudflare afterwards, or the domain stops working.
• Your server sees Cloudflare's addresses. Visitors' real addresses travel in a separate header, which logs and security tools need to read.
• Some visitors may be challenged. Bot protections can occasionally challenge apps, monitoring tools or automated integrations that use your site.

These are the reasons the add-on includes Noiz doing the set-up and changes: the steps are easy to get wrong, and a mistake can take a site offline.

Where it fits with the rest of your protection

Think of it in layers. Noiz's server-side protections apply to every site on our hosting. Cloudflare adds filtering in front of the website. WordPress Care closes the holes attackers look for by keeping the site updated and patched. Email Security protects the mail that Cloudflare never sees. If your site is a target for floods, bots or automated attacks, add Cloudflare to your hosting plan or Cloud server from the client area, and we will set it up with you.

Sources

Checked 19 October 2026.

Cloudflare documentation

• Proxy status and proxying limitations
• Proxy use cases
• How Cloudflare works
• About DDoS protection
• WAF managed rules
• Universal SSL
• Encryption modes, Flexible and Full (strict)
• Bot Fight Mode
• Email issues
• Exposed IP address and protect your origin server
• Full setup
• DNSSEC

Noiz

• Shared hosting and Cloud servers (Cloudflare is added from the client area)
• WordPress Care
• Email Security add-on
• AI, Bot and Crawler Policy

Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.