Cloudflare for WooCommerce: the free performance layer.
DNS, CDN, JavaScript-free tracking, invisible anti-spam, edge cache — Cloudflare offers for free what most plugins charge for. Here's how to leverage it on WooCommerce.
It all starts with DNS.
Moving your DNS to Cloudflare is the first quick win. It's free, takes 15 minutes, and the benefits are immediate:
- Global CDN: your static assets (images, CSS, JS) are distributed across 300+ datacenters. A visitor in Tokyo gets files from Tokyo, not from your server in France.
- DDoS protection: included for free.
- Automatic SSL: Let's Encrypt certificate renewed automatically.
- HTTP/3 and QUIC: enabled with one click, for faster mobile connections.
Cloudflare Zaraz — GA4 tracking without tanking your site.
The classic problem: you install a GA4 plugin on WordPress, it loads a ~70 KB script on every page. Add Google Tag Manager (~80 KB), Facebook Pixel (~50 KB), and your performance budget explodes.
Zaraz does all of this server-side. Instead of loading third-party scripts in the visitor's browser, Zaraz runs them on Cloudflare servers (Workers). The visitor only downloads a micro-script of ~4 KB.
The advantages:
- Weight: ~4 KB instead of ~150-200 KB of third-party scripts
- Adblockers: tracking goes through your own domain, invisible to ad blockers targeting third-party domains
- Complete data: 30-40% of visitors block classic GA4. With Zaraz, you recover that data.
- Free on the Cloudflare Free plan
Compatible with:
Cloudflare Turnstile — the CAPTCHA that doesn't slow anything down.
Google's reCAPTCHA loads ~300 KB of JavaScript on every page where it's active. Turnstile does the same job with ~4 KB, without asking visitors to select traffic lights.
Why it matters for WooCommerce:
- Protects checkout against bots (fraudulent orders)
- Protects login and registration forms
- Compatible with block checkout and express payment buttons
Setup: free WordPress plugin "Simple Cloudflare Turnstile". Activation per form type. In "managed" mode, the challenge is invisible to most visitors — Turnstile only shows when it has a doubt.
Cloudflare APO — edge caching for WordPress.
Automatic Platform Optimization (APO) is a Cloudflare product at $5/month specifically designed for WordPress. It caches your HTML pages on the Cloudflare network — not just images and CSS, but the entire page.
The result:
- TTFB < 100ms from anywhere in the world
- Your origin server is only hit when the cache is invalidated
- Automatic invalidation when you publish or update content
Watch out for WooCommerce:
APO must be configured with bypass rules for dynamic pages: cart, checkout, customer account, pages with WooCommerce session cookies. Without these rules, one visitor could see another's cart. That's exactly the kind of configuration I set up.
Cloudflare is probably the best investment for your WooCommerce.
Free DNS, free CDN, free Zaraz, free Turnstile, APO at $5/month. I configure all of it properly, with the right bypass rules for WooCommerce.