Cloudflare Pro and WordPress APO review

What does Cloudflare offer with their paid Pro service plan – and is it worth it? I was curious to find out, so I decided to try it – and document my experience and impressions here. 🙂
The Cloudflare Pro plan includes the benefits of the Cloudflare WordPress APO (links to Cloudflare’s website), so I tested that too.
This isn’t a real review as much as my notes on everything I’ve noticed about these services – trying to figure out if they’re worth it for me.
In a separate article, I’ve explained how to configure Cloudflare’s free plan for WordPress.
Note:
See my forum’s discussion thread about “Cloudflare being shady” – and consider that before deciding whether to go with Cloudflare.

If you have any questions (or additions and corrections), please use the BikeGremlin forum:
www.bikegremlin.net

Table Of Contents (T.O.C.):

1. Introduction
2. How to “install” Cloudflare?
3. Cloudflare dashboard overview
4. Cloudflare WordPress APO
   4.1. WordPress APO plugin configuration
   4.2. Testing if APO Edge caching works
5. Cloudflare Pro
6. Speed and stability testing results
7. LiteSpeed Enterprise vs Cloudflare WordPress APO
8. Conclusion
9. Trouble(shooting)
   9.1. Firewall problem (working “too well” 🙂 )
   9.2. Huge CLS problem with mobile phones
   

1. Introduction

I’ve been using Cloudflare’s free plan since 2019 (or 2018, I’m not sure). In its free plan, Cloudflare provides extra security, makes website migrations faster and easier, and offers some performance boost. Here, I explained what Cloudflare is and how it works.

I’ll debunk a common myth: in its free version, Cloudflare isn’t a real CDN.

For static HTML websites, it can easily be configured to act as a CDN by adding a “Cache Level – Cache Everything” directive in the “Page Rules.” However, this doesn’t work well for dynamic content. For example, you don’t want webshop visitor A to see the basket contents of visitor B.

Still, you can force it to work even for dynamic stuff (like WordPress, WooCommerce etc.) by using some of these “tricks:”

• Using Cloudflare workers (link to their website docs).
  This requires a lot of time, trial and error, and they charge you after 100,000 daily requests (this last item still doesn’t worry me).
• Using the free WordPress plugin Super Page Cache for Cloudflare (link to wp.org).
  I tested it for about a year. As with any other WordPress plugin, some updates cause hiccups, or some other plugin update causes conflicts.
• Using Cloudflare WordPress APO (described in this article) – for $5 monthly per domain.
• Using a “Bypass cache on cookie” page rule that comes with the Cloudflare Business plan – $200 monthly.

The plugin mentioned above is good, and I’d recommend it as a free solution for WordPress websites. Likewise, suppose you have enough knowledge and time. In that case, you can configure Cloudflare Workers yourself (and make your own plugin/WP implementation for deleting stale Cloudflare Edge cache).

Aware of my time and technical knowledge limits, I decided to try Cloudflare WordPress APO (Automatic Platform Optimization). It comes with its own plugin to take care of the cache “refreshing” when website content is changed. I hope Cloudflare’s “official” plugin will work even more stably than its free alternative.

I also wanted to try Cloudflare Pro. It provides better security (improved firewall protection) and some extra speed options.

• Cloudflare WordPress APO costs $5 per domain monthly.
• Cloudflare Pro costs $20 per domain monthly, with WordPress APO included (“free of charge”).

I would not pay for APO without the extra Pro security, nor would I pay for Pro without the APO caching improvements.

If you’d like to know how to configure all that, what exactly it provides, and how it performs in practice (vs free Cloudflare + LiteSpeed) – read on.

– T.O.C. –

2. How to “install” Cloudflare?

For a start, open a Cloudflare account. It’s free, and the procedure is more straightforward than making a Gmail account, so I won’t discuss it here (you can watch the video below for all the details).

After that, click on the “Add a Site” button to add a domain to Cloudflare. It will give you nameservers to add to your domain registrar (how to add Cloudflare nameservers).
I use and recommend Porkbun domain registrar (how to move a domain to another registrar).

Cloudflare should import all your existing DNS settings. In case you are starting from scratch, or have any problems, here’s how to configure Cloudflare DNS.

Finally, you should configure all of Cloudflare’s basic, free options. I wrote a general tutorial for that, with an emphasis on WordPress: “How to configure Cloudflare for WordPress?“

In the rest of this article, I’ll only deal with the extra options that become available with Cloudflare Pro and WordPress APO.

I’ve made a detailed, complete video tutorial on how to create, secure and configure a Cloudflare account – and how to connect it to your website:

– T.O.C. –

3. Cloudflare dashboard overview

My guide for configuring (free) Cloudflare for WordPress used the old Cloudflare dashboard design. I prefer it. It’s nicer and easier to use:

Unfortunately, they’ve removed the old design, so now we all have to use this one:

In this article, I’ll refer to the options’ (and sub-options) layout and structure as shown in picture 2.

– T.O.C. –

4. Cloudflare WordPress APO

Let’s begin with WordPress APO and see what it offers. In theory, it should create copies of your site’s contents on all its Edge cache servers spread worldwide. Then it should serve your site’s contents from the Edge server closest to the visitor – for each visitor. Chapters 6 and 7 show my tests of this system’s performance.

For a start, you should backup everything, just in case. Then, deactivate (and uninstall) any other caching plugins (like LiteSpeed cache). Now install the official Cloudflare WordPress plugin.

The plugin offers automatic Cloudflare configuration for WordPress. Still, chapter 2 gives you a link to a manual setting tutorial, which I prefer for more control.

Before we dive into the plugin configuration, let’s see what WP APO options need configuring on Cloudflare’s dashboard:

8. Speed -> 8.2. Optimization
Automatic Platform Optimization for WordPress

Even if your website is mobile-friendly (or mobile-first), check the “Cache By Device Type” checkbox.

– T.O.C. –

4.1. WordPress APO plugin configuration

If you haven’t already created (and configured) a Cloudflare account, I suggest you do that first. Then, use the activated plugin to log into the account:

Next, enter your email and API credentials:

If you’ve configured it all manually, all you have to do is activate WordPress APO: 🙂

Instructions on manual configuration using Cloudflare’s dashboard are given in chapters 4 (this one) and 5 (next one) of this article, and in the article about configuring Cloudflare for WordPress (for the free-options configuration).

The plugin allows you to click on one button and have all the options configured to what Cloudflare considers to be the best setup for WordPress. Here’s a list of Cloudflare’s recommended settings for WordPress (CF website link).

– T.O.C. –

4.2. Testing if APO Edge caching works

To confirm WordPress APO cache works, we should test it. Here’s how to do that:

• Open Chrome browser’s “New incognito window” (CTRL + SHIFT + N).
• Press the F12 button.
• Go to the “Network” tab.
• Uncheck the “Disable cache” option.
• Open a page on your website.
• Click on the first item in the list.
• Go to the “Headers” tab.

– T.O.C. –

5. Cloudflare Pro

A brief overview of the Pro service options.
I marked the options I don’t use with an asterisk ( * ).
Two asterisks ( ** ) mark the options that sometimes need to be disabled.

6. Security -> 6.2. WAF -> 6.2.3. Managed rules
Better firewall protection compared to the free package.

Cloudflare Managed Ruleset – Enable the following:
Miscellaneous, PHP, ** Specials, WordPress

Package: OWASP ModSecurity Core Rule Set
Sensitivity: ** Low
Action: Legacy CAPTCHA
Disable the following:
OWASP Slr Et Joomla Attacks, OWASP Slr Et PhpBB Attacks

** If you have problems updating WordPress widgets, temporarily disable the “Specials” ruleset, and set “OWASP Sensitivity” to “Off”.

6. Security -> 6.2. WAF -> 6.2.4. Tools
The Zone Lockdown option lets you allow only listed IP addresses to access a specified URL. This is useful to protect an admin or protected area from non-listed IP addresses.

6. Security -> 6.3. Page Shield
Enabling this protects your visitors from Magecart-style supply chain attacks that steal credit card information and sensitive data through malicious third-party dependencies (good for webshops).

8. Speed -> 8.2. Optimization
* Image Resizing – Allows image resizing (in pixels) and even conversion to WebP format on the Edge servers that serve cached contents.
* Polish – Translates your website to this beautiful Slavic language… I’m joking. 🙂 It compresses your images if you hadn’t done your homework before uploading them to your website.
Enhanced HTTP/2 Prioritization – Optimizes the order of resource delivery.
TCP Turbo – TCP (Transmission Control Protocol) optimization for reducing latency.
* Mirage (BETA!) – Faster image loading for mobile phone visitors.
* Automatic Signed Exchanges (SXGs) (BETA) – Speeds up LCP (Largest Contentful Paint) for Chrome-like browsers by letting them prefetch content from Google’s search results page.

9. Caching -> 9.1. Overview -> Cache Analytics
Cache-related statistics. Available with the Pro plan.

* 13. Traffic -> 13.5. Health Checks
Get feedback on latency, uptime, and see any errors – for various global locations (as you configure it). I use the free HetrixTools for this (affiliate link).

14. Custom Pages
* IP/Country Block – Let’s you display your own page with an explanation of why you are an idiot who blocks visitor access from entire countries based on their IP address.
* WAF Block – Custom page explaining whatever you think is wise to explain when a visitor is blocked by a firewall rule.
* 500 Class Errors – Same, but for 500 errors
* 1000 Class Errors – Same, again.
* Always Online™ Error – Same, for the case when Alway Online hasn’t got a cached page copy to show in case the site has crashed.
* Legacy CAPTCHA Challenge -Serve your own CAPTCHA page if you like.
* Managed Challenge – Same, for the managed challenge rules.
* Country Challenge – Same, for Country challenge rules.
* I’m Under Attack Mode™ / JavaScript Challenge – Same, again, for those rules.
* 429 errors – Show your custom page to visitors who’ve hit a rate limit.

– T.O.C. –

6. Speed and stability testing results

My websites ran on a LiteSpeed Enterprise server, using the free LiteSpeed WordPress plugin, and with Cloudflare Railgun enabled.

In 2022, on July 15th, I activated Cloudflare Pro and WordPress APO. Here is my test setup by websites:

• A – bicikl.bikegremlin.com – left it with LiteSpeed cache plugin, as before, but added the Cloudflare Pro boost options.
  (cycling website in Serbocroatian)
• B – bike.bikegremlin.com – uninstalled the LiteSpeed cache and installed the Cloudflare plugin (so, Cloudflare Pro + WordPress APO).
  (cycling website in English)
• C – io.bikegremlin.com – let two plugins work in parallel: LiteSpeed and Cloudflare plugin (Cloudflare Pro + WordPress APO + LiteSpeed).
  (IT-themed website)
• D – blog.bikegremlin.com – control website, LiteSpeed uninstalled, Cloudflare plugin installed.
  (my blog that no sane person reads 🙂 )

The first three websites see visitors from all around the world. Generic tests show the best results with option B and the worst results with option A. The C setup is closer to B (i.e. faster performing) than A.

My concerns:
Regarding setup C, will the cache be updated adequately for edited pages or pages where a comment is added? Because with setup C, I am using two caching plugins/setups in parallel.

During the initial testing, my concerns were confirmed. LiteSpeed combined with WordPress APO resulted in cache not being correctly invalidated (refreshed). That’s why I immediately stopped testing setup C.

After having deleted the LiteSpeed plugin, I’m using the Advanced Database Cleaner Pro plugin (link to its website) for database optimization – and it’s stellar.

One of the setup B advantages over setup A is that it correctly refreshes only changed pages. Or only a part of a page, like the “latest comments” widget. Configuring LiteSpeed to do this (refresh only the edited widget on a page) is quite complex (at least for me).

I have also tested WordPress APO with the BikeGremlin webshop. All the updates were correctly shown on the frontend, as well as any cart updates and changes. Looks good.

Here are some speed test results for Australian visitors:

Note 1:
See chapter 9.2. Huge CLS problem with mobile phones.

Note 2:
When you activate APO plugin on a website, Railgun for that website will no longer work. That’s good – because with APO you are using the Edge caching servers. Railgun makes sense when you can’t effectively cache dynamic content on the Edge servers.

I tracked real-user page load statistics with Google Analytics.

These stats align with the generic test results from various geo-locations. My subjective impression is that with Cloudflare Pro configured, website A (that uses LiteSpeed cache) works just as fast. Only when I’m using a VPN from a location far away from the hosting server (like Hong Kong) do I see a slight speed difference in favour of site B (WordPress APO). Even then, both websites still load very quickly, but B is slightly quicker.

– T.O.C. –

7. LiteSpeed Enterprise vs Cloudflare WordPress APO

High-quality shared (and reseller) hosting providers usually have LiteSpeed Enterprise servers. So, as far as you as a customer are concerned, LiteSpeed is free. You just install and configure the LiteSpeed plugin.

Cloudflare WordPress APO costs $5 monthly per domain (if you have several websites on different subdomains, they are all covered by that one subscription).

Cloudflare Pro costs $20 monthly and comes with the WordPress APO included (free of any extra charge).

If we disregard the WordPress APO, LiteSpeed is the best solution for caching WordPress websites. You can easily integrate it with its own CDN – QUIC.cloud (link to their site) if you wish. QUIC.cloud’s downside is that it requires you to use their DNS for it to work **. This prevents you from using Cloudflare’s DNS and firewall protection. It’s fair to add that QUIC.cloud offers some of its security solutions, and it isn’t free (additional CDN locations and bandwidth are charged).
** See my comment below for more details on this. Thanks to Ivan Arnaudov and Fabian Kastner from WordPress for Business Facebook group for the feedback.

So far, I have used the “ordinary” LiteSpeed (i.e. no QUIC.cloud) combined with Cloudflare (that does speed things up even with its free service). For this test, I compared that setup against Cloudflare Pro and WordPress APO.

I’d say that LiteSpeed is a bit slower, especially for remote locations with a slow Internet connection. For example, my websites are hosted in the USA. When I access them from Serbia (Central Europe) using a slow Internet connection, I notice that the LiteSpeed version is a bit slower. It’s still fast, but APO is a bit faster.

A difference I think is important:
Even as an experienced, advanced WordPress user (almost a decade now), I find it too complicated to configure LiteSpeed to update only changes. That is: to not have to purge all the cache when a comment is added or an article published (i.e. to update only the “latest comments” widget). Cloudflare WordPress APO does this automatically, without a glitch.

Oh, and since this April, LiteSpeed’s Memcached object cache is not working. About once a year, on average, LiteSpeed update messes something up. Nothing major, LiteSpeed is still great, but that’s still a bit frustrating. Redis object caching works, and it’s better, but it’s not secure for shared/reseller hosting environments.

Now let’s take a look at the load tests. I tested from Australia and from the USA, with the hosting server in the USA:

As you can see, page load times for visitors near the hosting server are a bit longer (slower) with Cloudflare Pro + WordPress APO, compared to LiteSpeed. But, they are a lot better (faster) for visitors who are far away from the hosting server (on another continent).

For the bike.bikegremlin.com website, it is important to provide good performance for visitors from all around the world:

Note 1:
See chapter 9.2. Huge CLS problem with mobile phones.

I believe a person’s place of birth and residence shouldn’t be a limiting factor, and I try to make my websites reflect this philosophy.

– T.O.C. –

8. Conclusion

Note:
Before accepting any statements in this “Conclusion,” see chapter 9.2. Huge CLS problem with mobile phones.

• Cloudflare WordPress APO provides a real CDN service (unlike Cloudflare’s free plan).
• Cloudflare Pro provides additional security and speed.
• The biggest improvement is seen by visitors on a different continent from the hosting server’s location.
• Cache invalidation (refreshing upon content changes) works flawlessly, unlike LiteSpeed.

Is it worth it? Should you buy only the $5 WordPress APO or dish out $20 for the Pro?

In my opinion, LiteSpeed works wonderfully. Put it behind the free Cloudflare service and configure it.

Once (if ever) your website starts making enough money to justify the $20 monthly cost, go straight for the Cloudflare Pro. Yes, APO does speed things up, but you can achieve 90% of that by using LiteSpeed and the free Cloudflare service. Once you need extra speed and extra security, go with the Pro. 🙂

In other words: maybe my websites are super-optimized, but I haven’t seen any huge gains with Cloudflare Pro and APO compared to LiteSpeed, yet I’d be lying if I said they aren’t a bit better.

Of course, always use high-quality web hosting that enables Cloudflare Railgun integration.

– T.O.C. –

9. Trouble(shooting)

9.1. Firewall problem (working “too well” 🙂 )

I ran into a problem when updating custom HTML WordPress widgets. Cloudflare Pro WordPress websites are the only ones affected.

I solved the problem (explained in the link below) and updated this tutorial to prevent myself or anyone else reading this from running into the same problem.

Update:
Solving the WordPress widget update problem with Cloudflare Pro

– T.O.C. –

9.2. Huge CLS problem with mobile phones

Desktop results were very good, but mobile results were bad. The biggest problem was huge CLS (Content Layout Shift) while loading pages:

As you can see, LiteSpeed sorts this out a lot better. I couldn’t solve this problem in a few weeks. That’s why I decided to cancel the Cloudflare paid subscription. I saw no use for paying the Cloudflare Pro fee – those extra $20 are not justified for my use case. Not without a well-functioning CDN that APO delivers (but, apparently, doesn’t handle the page load optimizations properly).

So I went back to using the free LiteSpeed + free Cloudflare Railgun. Yes, the LiteSpeed plugin has problems with every 3rd update or so. Yes, it is annoying, and I have to test every functionality I can think of. Still, I can make that one work – unlike Cloudflare’s WordPress APO.

Guess I should give LiteSpeed QUIC.cloud a test after all. 🙂

If you have any questions (or additions and corrections), please use the BikeGremlin forum:
www.bikegremlin.net

– T.O.C. –

Author

Relja Novović

Relja is an avid cyclist, a pretty good bike mechanic, and a professional computer systems administrator – with decades of experience in both those fields (computers and bikes 🙂 ). Relja Novović’s credentials and a short biography