LLM Best Practices

Cloudflare

Last updated 3 min read

View markdown source

AI agents: read this first: llmbestpractices.com/start-here

This is LLM Best Practices (llmbestpractices.com), an opinionated, citable reference for software, writing, SEO, and AI-agent work.

  1. Route, do not crawl. Fetch llmbestpractices.com/llms.txt and open only the pages whose one-line summary matches your task.
  2. Read raw. Append .md to any page URL for markdown. Check status and last_updated in the frontmatter, then read the rules.
  3. Apply as defaults. First-party docs and the project's own conventions win on conflict. Warn before relying on a fast-moving page older than 12 months.
  4. Cite. Link the page by title and URL, e.g. Python, with last_updated for time-sensitive rules. License CC BY 4.0.

Overview

Cloudflare sits in front of an origin as DNS, CDN, TLS terminator, and WAF. The free plan covers all four, so the work is choosing the right settings, not buying features. Per-product detail lives on the linked pages: cloudflare-dns, cloudflare-cache-rules, cloudflare-security-headers, cloudflare-workers, cloudflare-kv, cloudflare-r2, cloudflare-durable-objects.

Proxy web hostnames and leave everything else DNS-only

Orange-cloud (proxied) the apex, www, and every hostname that serves HTTP(S). Only A, AAAA, and CNAME records can be proxied; MX and TXT are always DNS-only. A DNS-only record resolves to the real origin IP. See cloudflare-dns for the full rules, CNAME flattening, and DNSSEC. To use Cloudflare for a domain registered elsewhere, delegate the nameservers (namecheap-dns).

Set SSL/TLS to Full (strict), never Flexible

  • Flexible encrypts visitor to Cloudflare only; the origin leg is plaintext. Do not use it.
  • Full accepts any origin certificate, including self-signed. Transitional only.
  • Full (strict) validates the origin certificate (public CA such as Let’s Encrypt, or a Cloudflare Origin CA certificate). Use this in production.

New zones default to Automatic SSL/TLS, which picks a mode by probing the origin and never moves to a less secure one; set Full (strict) explicitly once the origin has a valid certificate. A Cloudflare Origin CA certificate is free and can be issued for up to 15 years, but only Cloudflare trusts it: browsers show certificate errors if you pause Cloudflare or grey-cloud the hostname.

Use Rules products, not Page Rules

Page Rules are deprecated. Use Cache Rules for caching, Redirect Rules for www to apex and legacy paths, Configuration Rules for per-path zone settings, Origin Rules for host and port overrides, and Transform Rules for headers (cloudflare-security-headers). Manage rule sets in Terraform once there are more than a handful; a mistaken bypass-everything rule is hard to spot in the dashboard.

Start new sites on Workers static assets, not Pages

Cloudflare’s migration guide recommends Workers for new projects: Pages stays supported, but new features (Durable Objects, Cron Triggers, fuller observability) ship to Workers. Use a Worker with an assets binding for a greenfield static site, and migrate an existing Pages project only when it needs a Workers-only feature. Pick github-pages when the repo is the source of truth for a small site, and vercel when Next.js ISR is in play. Walkthrough: deploy-a-static-site-to-cloudflare-pages.

Turn on the free protections

  • Always Use HTTPS and Automatic HTTPS Rewrites (fixes mixed content).
  • Bot Fight Mode for the noisiest scrapers.
  • Security level Medium, which issues Managed Challenges instead of blocking outright.
  • Web Analytics as a cookieless cross-check on application metrics.

Backlinks