Integrations / CDN
Cloudflare WordPress security with Stack Guard
Cloudflare and Stack Guard work well together, as long as each one knows the other is there. Stack Guard reads the real visitor address behind Cloudflare, warns when settings clash, and with Pro reads your zone settings directly.
What Stack Guard checks
Cloudflare WordPress security: what Stack Guard checks
Real visitor addresses
If Stack Guard sees a Cloudflare address instead of the visitor's, a single lockout would block everyone coming through that Cloudflare server. The compatibility check spots this and points to Trusted Proxy, where Auto suits Cloudflare.
Headers sent twice
If Cloudflare already sends HSTS, a Content Security Policy or X-Frame-Options, Stack Guard says so, so you keep one clear instruction for browsers.
Country blocking in the right place
Cloudflare can block countries before traffic reaches your server. Stack Guard suggests keeping country blocking in one place so a change in one never surprises you.
Cached sign-in page
A test request to your sign-in page shows whether Cloudflare or anything else is caching it, which would break CAPTCHA and lockout messages.
Recommended settings for Cloudflare
- Firewall tab, Trusted Proxy: Auto.
- SSL/TLS mode in Cloudflare: Full (strict), with a certificate on the server.
- Always Use HTTPS on, minimum TLS version 1.2.
- Exclude the sign-in address and wp-admin from any cache rule.
- Pick one place for HSTS and for country blocking.
- Content Security Policy: start from the Cloudflare Ready preset (Pro).
Watch for overlaps
- HSTS
- Country blocking
- Firewall rules
- Bot Fight Mode can challenge payment callbacks and your site's own scheduled tasks
With Pro
With Pro, add a read-only Cloudflare API token and Stack Guard reads your zone: SSL mode, Always Use HTTPS, minimum TLS, HSTS, APO, cache rules, Bot Fight Mode and firewall rules, and names anything that clashes.
Questions
Cloudflare and Stack Guard: questions
Do I need a security plugin if I use Cloudflare?
Yes, for most sites. Cloudflare filters traffic before it arrives, while a WordPress security plugin sees what only WordPress knows: who is signing in, two-factor, user roles, file changes and malware in your files.
Why does Stack Guard need Trusted Proxy behind Cloudflare?
Behind Cloudflare, every request arrives from a Cloudflare address. Trusted Proxy tells Stack Guard to read the visitor's real address from Cloudflare's header, so lockouts and bans hit the right person.
Does the Cloudflare check change my Cloudflare settings?
No. The token only needs read permissions, and Stack Guard only reads. Every fix is a step you take in Cloudflare yourself.
Which Cloudflare SSL mode should a WordPress site use?
Full (strict). Flexible leaves the last stretch between Cloudflare and your server unencrypted and can cause redirect loops with WordPress.
More integrations
Cloudflare is a trademark of its owner. Stack Guard is not affiliated with or endorsed by it.
Protect your Cloudflare site free
Install Stack Guard Free and open the compatibility check. It takes a minute.