Recommendation
Not necessarily, depends on luck, but most likely it can be faster.
Original Text
This article is transcoded by SimpRead, original link blog.tangwudi.com
Contents1 Preface 2 Fundamentals 2.1 Connectivity 2.1.1 DNS Anycast IP changes 2.1.2 Connection speed comparison 2.1.2.1 Comparison targets using Free accounts 2.1.2.2 Domestic access speed test (TTFB…
I first learned about Cloudflare around early last year, nearly a year ago. During this year, I have been using the Free account to enjoy many Cloudflare features (CDN caching acceleration, WAF, DDoS attack protection, Tunnel, worker, R2, etc.) for free. To be honest, my feelings have been complicated: on one hand, it’s great to get so much for free; on the other hand, I feel somewhat guilty for freeloading (I used to feel indebted to Microsoft for using pirated software and even bought a Surface Pro 4 at my own expense to compensate). At the same time, I was also curious about the extra features for Pro subscribers. After all, the annual fee for a Pro account is $20/month, which is not expensive—you can save that by skipping a monthly big meal. The key question is: are the additional features for Pro subscribers worth $20 compared to the regular Free users? (I believe most website owners using Cloudflare Free accounts share this question).
With this doubt, I searched online for a long time but found almost no detailed verification articles. Usually there are some forum questions with brief, subjective answers:
In fact, even Cloudflare’s official website writes very concisely:
So, what is the actual experience for Pro users? Does subscribing to Pro make you a superhero, or is it just throwing money away—like simply getting a paid badge as mentioned earlier?
I’m not someone who just follows the crowd. After all, Comrade Mao Zedong said: Practice is the only criterion for testing truth. So, full of these doubts, I spent $25 to subscribe to the Pro user and started a one-month try-out journey.
Note: I will summarize from four perspectives—fundamentals, performance optimization, security, and operations visibility.
Before using the Free account, my blog domain “blog.tangwudi.com” resolved to “104.21.x.1”:
After upgrading to Pro, the resolved IP changed:
The reason I pay attention to this is that I saw someone asking this question before:
However, even though my resolved IP changed after upgrading to Pro, I cannot determine the IP change situation for others upgrading to Pro, so I cannot draw conclusions. I can only say that upgrading to Pro has a “not small chance” of changing the resolved IP. I hope more Pro subscribers can leave comments about your situation.
Note 1: Around December last year, some domestic broadband users had abnormal access to my blog, and PT users should also remember that in December last year, many PT sites using Cloudflare (Free account) had abnormal web or tracker server access. This was because the “104.21.x.1” IP segment was blocked by the three major ISPs in China. China Telecom and China Unicom had regional access difficulties, and China Mobile was the worst, basically inaccessible nationwide. This situation began to slowly recover after January.
Note 2: Based on current observations, getting 3 IPs is most likely for Pro users, while getting 7 IPs (104.21.*.1) and two IPs (104.* and 172.*) is most likely for Free users.
So, is there a difference in actual connection speed after upgrading to Pro? I used ITDOG’s website speed test to compare my site with two other websites using Cloudflare Free accounts (famous PT sites “Some Crowd” and “Some Sky”) because their resolved IP is the same as mine on Free accounts (though IP may be similar, it doesn’t necessarily mean they are Free accounts, just a blind guess~).
Some Crowd:
Some Sky:
Some Crowd:
Some Sky:
Conclusion: The TTFB for Pro account domain names in domestic access is at least half less than the TTFB for Free account domain names.
Note: TTFB and the end user’s perceived website loading speed cannot be generalized, but for the same website, a shorter TTFB certainly improves the access experience.
Some Crowd:
Some Sky:
Conclusion: For international access, the TTFB of Pro account domains is in a totally different scale compared to Free account domains (0.0x seconds vs 0.x seconds or even multiple seconds), making comparison meaningless. However, the Free account’s sub-second TTFB is already quite fast in user perception, so for typical personal sites using Free accounts, the impact is not large. The key still lies in proper cache rule configurations and the site’s own optimization.
From the earlier TTFB tests for domestic and foreign access, Cloudflare Pro accounts and Free accounts differ significantly in access speed. However, Cloudflare officially never explicitly claims that Pro accounts have better speed or routes than Free accounts. So where does the acceleration effect of Pro accounts come from?
Actually, the speedup from Cloudflare’s paid plans is not simply through changing IP addresses or special routes, but relies more on underlying network optimizations, traffic scheduling priority, and more advanced cache strategies. These optimizations mainly lie in:
1. Visitor Traffic PoP (edge data center) allocation
Cloudflare owns over 300 PoPs worldwide, but account tiers have different traffic scheduling priorities:
Free account: low priority, possible detours
• Free account traffic may be routed to farther PoPs under heavy loads, increasing latency.
• Some high-performance PoPs may not be open to Free accounts, prioritized for paid accounts.
• Domestic users accessing Free account sites may experience detours, causing longer TTFB.
Pro account: higher priority access to high-performance PoPs, reducing detours
• Pro account traffic has load balancing priority to enter the nearest PoP, reducing detour latency.
• Though Pro accounts cannot specify PoPs like Enterprise accounts, they are more likely to access premium Cloudflare nodes, reducing access jitter.
• For overseas users, Pro account PoP selection optimization is more obvious, significantly lowering TTFB.
Real-world impact
• Domestic access: Pro and Free accounts differ little because Cloudflare has no PoPs in China, so traffic must detour overseas.
• Overseas access: Pro accounts usually get allocated nearer PoPs, thus TTFB is lower and experience better.
2. Origin Requests optimization
After visitor requests enter Cloudflare, if there is a cache miss, Cloudflare must still fetch data from origin. Different accounts have different origin request strategies:
Free account: possibly longer origin paths
• Free accounts have lower cache layer level and hit rate than Pro, causing more origin fetches.
• Origin requests may detour, as paths are not always optimal for Free accounts.
• This causes dynamic content loading (e.g., API calls, database queries) to be slower than Pro accounts.
Pro account: optimized origin paths reducing origin load
• Better cache management reduces unnecessary origin fetches, improving site performance.
• Origin paths are generally more optimized than Free, though not as good as Enterprise’s Argo Smart Routing.
• Optional Argo Smart Routing further improves origin speed and reduces network jitter.
Real-world impact
• If the site mainly relies on static content (blogs, image sites), Pro accounts have higher cache efficiency, reducing origin fetch and speeding access.
• If the site mainly serves dynamic content (APIs, DB queries), Pro’s origin optimizations may enhance stability but won’t reduce origin fetch frequency.
Although Pro accounts bring real speed improvements in PoP selection and origin optimization, Cloudflare emphasizes Pro accounts as having ‘functional improvements,’ not just acceleration. Why does Cloudflare avoid directly advertising “Pro accounts are faster,” instead focusing on functional differences? I think it may be for these three reasons:
1. User experience depends on network environment:
• Cloudflare acceleration depends on user geography, ISP providers, and site content types, etc.
• For overseas users, Pro account PoP optimizations bring faster speed.
• For domestic users, since Cloudflare has no PoP in China, Pro account speed improvements are less obvious, and the company avoids misleading statements.
2. PoP allocation is dynamic and not guaranteed 100% consistent:
• Cloudflare dynamically adjusts PoP allocation according to load, so even Pro accounts can’t guarantee always routing to the nearest PoP.
• Such dynamic scheduling means Cloudflare can’t promise fixed acceleration, so the distinction between Pro and Free is mainly on features.
3. Cloudflare prefers to emphasize security and optimization features:
• Cloudflare’s core business is not just CDN acceleration but a comprehensive network security and optimization platform.
• The real value of Pro accounts lies in stronger WAF rules, better DDoS protection, and more flexible cache strategies, which Cloudflare prefers to highlight.
This part includes features also available in the Free account, just with smaller quantity limits. After upgrading to Pro, the corresponding configuration limits increase significantly. Here are some commonly used examples:
- Number of Page Rules
- Free account 3 rules:
- Pro account 20 rules:
- Number of WAF custom rules
- Free account 5 rules:
- Pro account 20 rules:
- Number of Rate Limiting rules
- Free account 1 rule:
And when rate limiting is triggered, it can only block for 10 seconds:
- Pro account 2 rules:
And when rate limiting is triggered, can block for up to 1 hour with customizable response types:
- Number of Cache Rules
- Free account 10 rules:
- Pro account 25 rules:
The above lists the commonly used ones; I won’t list the less used rules one by one. Officially, the Pro plan has 155-65=90 more rules than the Free plan:
Note: The additional rate limiting rule helped me a lot—it can be used to protect sensitive WordPress paths, for example, setting a separate rate limit for “/wp-admin/admin-ajax.php”. Previously, I had to split this traffic and send it to an internal long-term WAF for rate limiting (see article: Home Data Center Series Cracking WordPress AJAX Protection Problem: Using Cloudflare Tunnel to achieve normal access and “traffic split” protection for attack traffic), now it can finally be handled in the cloud. The quantity difference for the other rules has less impact on me: multiple “or” conditions can be used in the same rule.
Image optimization is a very important part of website optimization, and this feature is unavailable in the Free account:
Note: Image conversion requires Cloudflare Image (paid) and adding specific width and height parameters to image URLs, which is unsuitable for lazy people like me, so it is not discussed here.
After enabling Pro, Polish and Mirage can be used:
Cloudflare’s image optimization feature Polish can automatically compress and optimize images on the site to improve page load speed and reduce bandwidth usage: it optimizes images through lossless and lossy compression, supports conversion to WebP format, providing more efficient image presentation. Polish also intelligently chooses the best image format and quality based on the visitor’s device and network conditions, further improving browsing experience. Enabling Polish significantly speeds up image loading, especially on mobile devices, boosting overall site performance and responsiveness.
Compared to image conversion, Polish’s biggest advantage is no hassle: images do not need to be stored on Cloudflare Image and can remain on your own server or other supported cloud storage (such as Cloudflare R2). Polish automatically optimizes and compresses images during transfer without manual adjustment of source files. Note that Polish works only for domains proxied through Cloudflare, so ensure the image hosting domain is proxied by Cloudflare.
How effective is Polish optimization? Taking an image stored on R2 as an example, the original size is 234 kB:
After Polish optimization, converted to WebP format, the size is only 130 kB, 104 kB less:
The image was directly converted to WebP and reduced in size by nearly 45%. This optimization is really powerful, and the key is I did nothing but flip a switch—so it’s a very convenient optimization feature for lazy people.
Note 1: Polish only works on images that are already cached by the CDN; images not cached will not benefit from Polish.Note 2: Another meaningful parameter is Cf-Bgj, imgq:100 indicates that the image quality is not reduced because I selected the “lossless” mode in Polish.
Cloudflare’s Mirage feature is an image acceleration tool optimized for mobile devices and low-bandwidth networks. It helps reduce page load times by intelligently adjusting how images are loaded and their quality, especially under slow network conditions. Mirage dynamically provides images sized and optimized according to the user’s device screen size, resolution, and network conditions, effectively reducing bandwidth consumption and enhancing user experience. It can also lazy-load images (load on demand), ensuring that images are only loaded when needed, further optimizing website performance. Overall, Mirage makes web pages load faster on mobile devices, improving the site’s overall speed and smoothness.
However, Mirage’s effects are not as easy to observe as Polish (it requires slow network conditions, and device and network simulation in Chrome DevTools may not work well), and since it doesn’t have obvious indicators, I didn’t bother taking screenshots for it.
Note: Actually, Polish also benefits mobile devices. Polish’s image optimization not only compresses and optimizes images but also intelligently selects suitable image formats and quality based on the visitor’s device and network conditions. For example, Polish can convert images to the lighter WebP format, which is especially favorable for loading speed on mobile devices because WebP files are typically smaller than traditional JPEG or PNG files while maintaining good image quality. However, Polish focuses more on optimizing image size and format rather than the additional intelligent mobile-specific adjustments (such as dynamic image resizing and lazy loading) that Mirage provides. Therefore, Polish still improves image load speed on mobile, but for deeper mobile-specific optimizations like lazy loading and device adaptation, Mirage or other technologies may be more suitable.
Besides APO, all other content optimization features are already available in the Free plan, so I mainly focus on APO, but I can also briefly mention Rocket Loader since this feature is also quite important:
Cloudflare’s Rocket Loader is a feature that shortens page load time by deferring the loading of non-critical JavaScript scripts on the webpage. It delays loading non-essential scripts and prioritizes loading resources vital for page rendering, reducing blocking time. This deferred loading method ensures that page content is presented to users faster, improving overall load speed and user experience.
Some WordPress plugins also implement similar features, like WP Rocket, which can delay execution of non-critical JS files and also optimize JS script concatenation (it can do the same for CSS).
I previously did a comparison and found that the effects of using WP Rocket and Rocket Loader are not significantly different, so naturally I prefer to install fewer plugins and use Cloudflare’s cloud-based solution instead. Combined with Zaraz for third-party script cloud loading and management, this greatly “lightens the load” for WordPress. Of course, WP Rocket has other very practical functions, which are related to the APO feature introduced in the next section.
In my previously written Cloudflare series tutorial Part 7 (see: Home Data Center Series Cloudflare Tutorial (7) Introduction to CF Worker Functionality and Practical, Verification, and Related Technical Research on “Beggar Version APO for WordPress” Based on Worker to Accelerate Website Access) regarding using Worker to accelerate website access, I have already introduced the APO feature:
Simply put, only two steps are needed:
- Enable the APO toggle in the Cloudflare dashboard:
- Install and activate a Cloudflare plugin in WordPress (with very simple initial configuration):
After completing these two steps, you can enjoy Cloudflare’s globally optimized CDN based on Worker, automatically covering HTML, JavaScript, CSS, and image resources in WordPress with unlimited traffic support. Most importantly, enabling APO not only improves site performance through caching and optimization but also brings other significant benefits:
Firstly, APO automatically enables intelligent caching for your WordPress site without requiring manual configuration of complex page rules or caching strategies. Traditional optimization often requires plugins like WP Fastest Cache or WP Rocket to manage local caching, JS, and CSS optimization, as well as manual cache rule setup in the Cloudflare dashboard, and sometimes configuration of Worker and KV for optimization. In comparison, APO automates these optimizations through Cloudflare’s system, saving complicated configurations and reducing the possibility of human errors, greatly simplifying the optimization process.
Secondly, APO avoids the complex cache logic frequently involved in traditional optimization. Previously, WordPress caching strategies were often not granular enough, requiring manual cache rules for different resources or relying on Worker and KV for fine-grained control. After enabling APO, Cloudflare automatically handles all caching and optimizations for images, HTML, JavaScript, etc. without manual intervention.
Most importantly, APO leverages Cloudflare’s global CDN network to ensure fast loading of site resources regardless of user location, significantly enhancing page response speed and user experience. Especially for global visitors, APO’s optimization effectively reduces geographic latency and improves access speed.
In summary, after enabling APO, your WordPress site benefits not only from more efficient caching strategies and optimizations without manual configurations but also from Cloudflare’s powerful global network support and unlimited traffic capacity (previously when using Worker-based optimization, the biggest worry was DDoS attacks due to the free quota of 100,000 requests/day being insufficient), greatly simplifying performance optimization and enabling smoother, more efficient site operation.
Note 1: Even Free accounts can subscribe to APO separately (5 USD per month), so if you were already subscribed to APO on a Free account and then upgrade to Pro annual membership, it’s basically only an additional 15 USD per month. Doesn’t that suddenly feel like a great deal?
Note 2: APO is a feature designed specifically for WordPress sites. Cloudflare mainly provides this service via deep integration with WordPress (since WordPress holds a large global market share, with a strong user base). Thus, for Pro subscribers not using WordPress, this feature is essentially wasted.
Note 3: APO and Rocket Loader (mentioned in the previous section) can work simultaneously and complement each other to improve site performance. APO optimizes and caches static WordPress site resources (HTML, CSS, JavaScript, and images) through Cloudflare’s global CDN, accelerating page load and reducing origin server load; while Rocket Loader mainly optimizes JavaScript loading order by deferring non-critical script loading, ensuring page content is presented first to reduce render blocking. When used together, APO provides whole-site caching and resource optimization, and Rocket Loader focuses on script loading, significantly boosting site speed and user experience. However, WordPress usually has related local optimization options, such as the Argon theme I use which already has image lazyload:
It is recommended to disable local optimization options and let Cloudflare handle everything to avoid conflicts.
I won’t go into more detail here. The Pro-only option is “Enhanced HTTP/2 Prioritization,” while other features are also available in the Free plan. You can check the annotations and basically enable them all. However, site owners caring about visitors from China should be cautious about enabling the “HTTP/3” option because QUIC UDP port 443 traffic is quite conspicuous (and this traffic must pass through certain firewalls), making it an easy target.
A Pro-only feature here is the Automatic Signed Exchange (SXG) functionality:
After enabling Automatic Signed Exchange (SXG), Google no longer acts solely as a traditional search engine that forwards access requests to the site but also serves as a cache server that directly responds to user requests with cached content. This means Google can perform secure signed exchanges with visitors, ensuring the integrity and validity of cached content while significantly accelerating page load speeds. This reduces page load latency and improves the Largest Contentful Paint (LCP) metric within Core Web Vitals, thereby enhancing user experience and indirectly boosting SEO rankings.
The concrete effect after enabling is an additional source domain: “blog-tangwudi-com.webpkgcache.com”:
Correspondingly, the number of requests from “google.com” decreases.
For Pro users, besides the increased number of supported custom WAF rules, the most critical change is managed rules.
Cloudflare WAF provides “free managed rules” for Free users. According to official statements, they “offer basic WAF protection, mainly against common attack types like SQL injection and cross-site scripting (XSS).” In practice, however, these protections are quite limited, almost negligible. Previously, I mainly relied on Changting Leichi Community Edition (now renamed Personal Edition) within my internal network to block most attacks, then used the Wordfence plugin in WordPress as a second layer of filtering to ensure safety. Generally, only after multiple repeat attacks were blocked by Changting Leichi WAF would I manually add custom block rules in Cloudflare WAF.
From this perspective, the WAF function for Free users can be seen as an almost transparent component that doesn’t provide much protection by default; its real effectiveness depends on users’ subsequent manual interventions and rule additions.
But it’s different after upgrading to Pro:
For Pro users, Cloudflare WAF provides two important managed rule sets: Cloudflare Managed Ruleset and Cloudflare OWASP Core Ruleset, both playing significant roles in protecting websites against various web attacks:
1. Cloudflare Managed Ruleset
Overview: Cloudflare’s Managed Ruleset is a set of preconfigured rules designed to prevent common web attacks such as SQL injection and cross-site scripting (XSS). Cloudflare automatically updates and optimizes protection strategies via these rule sets without requiring manual user configuration.
Features:
• Automatic Updates: Rules are updated constantly to respond to new security threats.
• Efficient Protection: Covers common attack vectors including CSRF and file upload vulnerabilities.
• No Manual Intervention: Automatically enabled without additional user configuration.
• Periodic Optimization: Cloudflare regularly refines the rules based on global traffic and security trends to improve detection accuracy and reduce false positives.
Use Cases: This is a convenient and effective protection solution for users who do not have much time or resources to manage WAF settings.
Currently, there are 34 WordPress-related rules in the managed rule set, which gives me, as a WordPress user, a much greater sense of security instantly:
2. Cloudflare OWASP Core Ruleset (CRS)
Overview: The OWASP Core Ruleset is developed based on recommendations and best practices from the OWASP (Open Web Application Security Project). It covers the most common web security risks listed by OWASP and protects against attacks such as SQL injection, XSS, and command injection through these rules.
Features:
• Comprehensive Attack Protection: CRS aims to guard against the top 10 most common and dangerous web vulnerabilities listed by OWASP.
• Deep Protection: Compared to Cloudflare Managed Ruleset, CRS covers a wider range of attacks including complex types like XML External Entity Injection (XXE) and Remote File Inclusion (RFI).
• Flexibility: Allows users to enable/disable specific rules or customize rules for particular web application scenarios.
• Open Source Support: CRS is open source, allowing modifications and extensions as needed.
Use Cases: Ideal for deeper web application security needs, or sites handling sensitive data, especially those needing to comply with security standards like PCI-DSS.
With these two rule sets, Cloudflare Pro users gain more powerful and flexible security protection, effectively reducing potential network attack risks. For example, I have been using the two managed rule sets for some time, and the number of attacks blocked by my internal Changting WAF has greatly decreased (Community edition doesn’t allow time period selection, only sees today’s blocks):
Most blocked requests are due to rate limiting:
And the WordPress Wordfence plugin’s real-time traffic mostly consists of login events now. After observing for another two days, I can uninstall it (WordPress lightweighting has taken a big step forward).
Note: Users familiar with WAF rules can modify managed rules based on their actual needs, while less experienced users should generally keep the default configuration, which is Cloudflare’s recommended best practice suitable for most users.
By the way, someone previously made a Traditional Chinese mirror site for me:
A brief investigation showed it used reverse proxying, disguising their UserAgent as Googlebot to pass through Cloudflare Free account’s free managed WAF rules. Before upgrading to Pro, I manually added a custom WAF rule: “Block all requests with UserAgent containing Googlebot but not originating from Google ASN” to deal with this.
Now after upgrading to Pro, no rules need to be added; the managed rules block them directly:
For Cloudflare Free users, after enabling “Automated Bot Attack Mode”, Cloudflare performs basic automated traffic identification and blocking. For example, Cloudflare can detect some common automated attack behaviors such as malicious crawlers and brute-force attacks, and will use CAPTCHA or JavaScript Challenges to verify whether traffic is malicious automation. In this case, automated traffic is treated as malicious traffic and is challenged or blocked to protect the site.
However, by default Cloudflare allows another category called “Definitely Automated” traffic, which does not exhibit obvious malicious behavior but is still generated by automated programs. Examples include:
• Web Crawlers: Not necessarily malicious but frequently accessing the site to collect data.
• Automation Scripts: Used for large scale data requests but without brute force or other attack behaviors.
“Definitely Automated” traffic is fully automated script- or tool-generated traffic, typically with no user interaction. Identification is relatively complicated, and Free Cloudflare accounts can only perform basic screening with loose rules and cannot finely control this traffic.
In short, enabling “Automated Bot Attack Mode” causes Cloudflare to block obviously malicious automated traffic (e.g., brute forcing logins or scraping sensitive data), enforcing challenges to confirm request legitimacy. However, for “Definitely Automated” traffic, which lacks malicious characteristics and high-frequency or harmful request patterns, Free users cannot define handling methods, so this traffic is allowed by default, without triggering blocking or verification.
After upgrading to Pro, more functions appear in the automated program protection:
In the detailed automated program protection configuration, an option to handle “Definitely Automated” traffic is finally available:
Compared to Free users, Pro users can set how “Definitely Automated” traffic is treated, for example, setting it to “Managed Challenge” to avoid false positives.Although Pro users have significantly improved ability to identify “absolute automated” traffic compared to Free users, there are still some challenges: The characteristic of “absolute automated” traffic is that it usually lacks obvious malicious behavior or attack features, so accurate identification remains somewhat difficult, especially for automated traffic with low frequency and behaviors similar to normal users, which might be mistakenly identified as legitimate requests, making 100% accuracy impossible. In such cases, relying solely on automatic detection is insufficient to completely prevent all malicious automated traffic (simply put, the absolute automated rules mainly target relatively simple automated programs with obvious behavior patterns, usually low-end crawler scripts or basic automation tools that generally lack advanced anti-detection capabilities and are easily detected by Cloudflare’s standard rules).
However, combined with Pro users’ WAF managed rulesets, especially protection rules against common attack patterns such as SQL injection, cross-site scripting, etc., the defense effectiveness against “absolute automated” traffic can be greatly enhanced, improving identification accuracy and reducing false positives (the interception of malicious reverse proxy traffic to mirror sites mentioned earlier is an example). Therefore, through flexible configuration of WAF rules and enabling automation protection, Pro users can more effectively handle these hard-to-identify automated traffic and improve overall security.
By the way, Cloudflare Business and higher tiers have a more advanced “Bot Management” that uses machine learning, behavioral analysis, fingerprinting, and other technologies to analyze and identify traffic, allowing more precise detection of automated programs (such as crawlers, malicious reverse proxies) and take corresponding actions (like challenges, blocking, etc.). Unfortunately, at a price of at least $200 per month, it’s too costly even if I’m willing to make great sacrifices.
Meanwhile, WordPress users again have an affordable advantage. After enabling the “Optimize for WordPress” toggle, Cloudflare applies specific optimizations for common attacks and malicious automation on WordPress, including but not limited to:
- Preventing brute force login attempts: WordPress login page /wp-login.php and admin area /wp-admin/ often become attack targets, especially brute force attempts to obtain admin passwords. Enabling this option allows Cloudflare to more actively detect automated traffic targeting login pages and use CAPTCHA or JavaScript challenges to block such malicious requests.
- Restricting access to common entry points: Common exposed interfaces in WordPress sites (such as /wp-login.php, /wp-admin/, /xmlrpc.php) often face attacks from malicious crawlers and automation scripts. This option optimizes Cloudflare’s protection of these interfaces to reduce the risk of attacks from malicious automated traffic.
- WordPress-specific malicious traffic identification: For some unique behaviors of WordPress, enabling this option lets Cloudflare use special rules and algorithms optimized for WordPress to improve identification efficiency and avoid blocking legitimate traffic.
- Automatic handling of WordPress-specific attack patterns: WordPress is often targeted by automation scripts and crawlers, and such traffic may not only be malicious but also large-scale data scraping. Enabling this option helps Cloudflare pay special attention to these traffic patterns and perform targeted optimization.
In short, WordPress users benefit once again.
From Free users having almost no WAF managed rules and rudimentary automated program attack detection, to Pro users having two major managed WAF rulesets and competent identification and unified handling of “absolute automated” traffic, this has led me to rethink my overall site security strategy.
One dilemma I had before was that if the home data center went completely down (power outage, network disconnection), although the probe scripts running on Tencent Cloud lightweight server would detect this and automatically activate the backup connector of the home data center Cloudflare Tunnel, so the disaster recovery site on Tencent Cloud server would become the main site to restore service (see article: Home Data Center Series: Using Cloudflare Tunnel to Automatically Take Over DR Site When WordPress Main Site Fails), the security aspect would be greatly compromised because the home data center internally has an intranet WAF for secondary filtering.
But now, due to the huge security improvement for Pro users (actually, it’s just that Free users serve as the green background to highlight this~), even if the disaster recovery site on Tencent Cloud becomes the main site, the security issues can be disregarded in the short term.
At the same time, the originally very complex custom WAF rules (which were once the main security line for my website) have been thoroughly cleaned and optimized: I removed many outdated or no longer necessary rules, shifted the security focus from relying on these complicated custom rules to a more efficient and automated protection solution. Now, the custom rules that used to bear the major defense responsibility have become “auxiliary police” to catch the occasional overlooked threats, while the real security line is entrusted to “absolute automated” traffic managed queries and the two major WAF managed rulesets. This change allows me to respond to various automated traffic attacks more intelligently and accurately through Cloudflare, while reducing excessive manual intervention and rule maintenance, further improving security and management efficiency.
Note: Even if Pro users enable the two major WAF managed rulesets and identification of “absolute automated” traffic, it doesn’t mean you can be fully assured, after all, it is just one of the many services provided for $20 and can’t work miracles—just better than Free users. So my intranet WAF still remains in place (heterogeneous security devices still have meaning). For WordPress users, I still recommend installing the Wordfence plugin if possible (although it might add a few tens of milliseconds of “Total Blocking Time”).
Many people might not care about this part since I believe most do not frequently check Cloudflare’s Web dashboard. However, for those in operations and maintenance or after-sales engineers who often troubleshoot, a backend system providing detailed monitoring, statistics, log queries, and analysis functions is crucial:
- When the website is under attack, it can respond quickly, identify attack source, type, and scope, and formulate corresponding defense measures.
- When the website experiences access anomalies, it can immediately check traffic status, cache hit rate, error logs to quickly locate issues.
- When performance optimization is needed, detailed traffic data enables analysis of site bottlenecks, adjustment of cache policies, WAF rules, or content delivery optimization.
Compared with the Free version, Pro users gain significant enhancements in operational visibility, summarized in the following three aspects:
1. More detailed analytics data
Pro users can access more detailed statistics than Free users in HTTP Traffic and Security Analytics, including:
• Richer metrics (like request volume, data transferred, page views, etc.)
• Advanced filters (filter by country/region, IP, data center, edge status code, etc.)
This data is very helpful for analyzing traffic patterns, optimizing caching, and adjusting security policies. This can be seen by comparing “HTTP Traffic” and “Web Analytics” in the “Analysis and Logs” sections for Pro and Free users.
HTTP Traffic:
Free version:
Pro version:
Web Analytics:
Free version:
Pro version:
It’s clear that Pro version provides much richer information in both “HTTP Traffic” and “Web Analytics” sections.
2. WAF event logs & rule match details
Free version WAF can only show the total number of blocked requests, without detailed blocking information. Pro version’s WAF event logs provide complete attack records, including:
• Triggered specific rules (e.g., OWASP rules, managed rules, IP restrictions)
• Attack source IP, country/region, User-Agent
• Detailed HTTP request information (e.g., request URL, parameters, body)
This is crucial for analyzing attack patterns and adjusting defense strategies, especially for false positive investigation, allowing precise judgment of which traffic should be allowed or which rules adjusted. This can be seen from the comparison of “Security” - “Events” interface content between Pro and Free users:
Free version:
Pro version:
Again, the Pro version provides much richer information in the “Security” - “Events” section.
3. Detailed DDoS attack reports
Free version only provides basic DDoS protection, while Pro version’s DDoS monitoring reports allow viewing:
• Specific attack types (e.g., SYN Flood, UDP Flood, HTTP Flood)
• Peak QPS of attacks, number of blocked requests
• Target URLs or ports under attack
During DDoS attacks, these data help site owners clearly understand attack scale and adjust Cloudflare rules for optimized defense. This feature also relies on the “Security - Events” section; I won’t repeat screenshots here. However, as always, this part may interest different people to varying degrees.
Note: Another Pro user benefit is that unlike Free users who can only seek help on community forums, Pro users can submit support tickets directly to open cases:
I haven’t tried it yet but will give it a shot sometime.
In previous articles, I detailed the many improvements of Cloudflare Pro compared to Free. But it needs to be emphasized again that Pro is not suitable for all sites; its main advantage is for frequently origin-pulling dynamic sites, especially WordPress users. To illustrate Pro’s value more intuitively, here’s a summary from the perspectives of static and dynamic sites:
Static sites: Free version is sufficient
For fully static sites, such as blogs generated by Hugo, Hexo, Jekyll, or pure HTML/JS/CSS documentation sites and corporate websites, Cloudflare Free already provides adequate protection and optimization. Static sites do not involve databases or backend APIs, so security risk is low, and the Free version’s default DDoS protection sufficiently handles common attacks. Moreover, these sites typically achieve full-site caching and have fast access speed themselves, so Pro’s dynamic optimization features are of limited significance. If site images are already manually optimized to WebP or compressed with TinyPNG, the extra boost from Pro’s Polish and Mirage features is also modest. Therefore, most static site users do not need to upgrade to Pro.
Dynamic sites (especially WordPress): Pro improvements are significant
For dynamic sites such as WordPress blogs, e-commerce, forums, etc., Cloudflare Pro’s value is very obvious. APO (Automatic Platform Optimization) reduces dynamic page origin requests, significantly lowering TTFB (Time to First Byte) and improving load speed. Meanwhile, Pro provides stronger WAF rules for effective protection against common WordPress attacks like SQL injection and brute force. Bot management reduces spam comments and malicious crawlers, further optimizing site operation. Additionally, Pro offers more detailed logs and security analysis, helping site owners better monitor traffic and optimize performance. Hence, for long-term dynamic sites, Pro is a worthwhile investment.
Based on the previous analysis, here is a reference table for those considering subscribing to Pro:
| Site Type | Cloudflare Free | Cloudflare Pro | Upgrade Recommended? |
|---|---|---|---|
| Pure Static Sites (Full Site Caching) | Basic Protection + High Cache Hit Rate | Limited Improvement (unless relying on Polish, Mirage) | Not recommended |
| Lightweight Dynamic Sites (Small Blogs) | May be limited by cache and WAF rules | Provides WAF managed rules; reduces junk traffic | Optional |
| WordPress Sites (with dynamic interactions) | Vulnerable to attacks; TTFB may be high | APO + WAF protection + Bot defense, boosting performance & security | Recommended |
| E-commerce / Forums / API Sites | Performance poor under high concurrency; high security risks | Stronger caching strategies + defense rules | Strongly recommended |
| Sites frequently facing DDoS or malicious traffic | Only basic DDoS protection | WAF managed rules + detailed attack analysis | Recommended |
Actually, I feel like I’ve boarded a thief’s ship: originally I just wanted to subscribe to one month of Cloudflare Pro to experience the various improvements and write a summary, then stop. But after all this trouble, I actually feel Pro is tailor-made for me and I’m even seriously considering subscribing to the annual plan. Although it means tight budgets, the significant reduction in daily blog maintenance time and effort makes it a worthwhile investment.
However, I want to emphasize again: Pro does not directly improve access speed for users in China. The reason I stress this is that I’ve seen many misunderstandings on various forums where people expect their China access speed to significantly improve after upgrading to Pro, only to find no real difference and claim Pro is useless. Remember this unchangeable fact: Cloudflare does not have its own nodes in China, so the direct speed optimizations from Pro only affect overseas users’ access.
For sites targeting China, real speed improvements still rely on Cloudflare APO, page optimization, cache strategies, and may even require domestic CDN. If you are willing to do ICP filing and value China access speed greatly, perhaps using a domestic CDN directly is a better choice. After all, even Cloudflare’s Enterprise version needs ICP filing to use domestic nodes like JD Cloud, and if you’re willing to file ICP, why bother detouring through Cloudflare?
In the end, whether Cloudflare Pro suits you depends on your needs: if your site audience is mainly overseas or if it’s a dynamic site (especially WordPress), the various optimizations of Pro are definitely worth investing in; if most visitors come from China and you have already optimized access speed by other means, the Free version might be enough.