Cloudflare: Beyond DNS

Build the mental model

Most people meet Cloudflare as a place to manage DNS records -- but DNS is only the entry point into a much larger edge platform.

A CDN caches static assets near visitors, cutting latency and reducing origin load.
DDoS protection and a Web Application Firewall (WAF) filter malicious traffic before it reaches your app.
Cloudflare Workers run real code at the edge -- close to the user, not in one central region.
Cloudflare Pages deploys static and full-stack applications directly from Cloudflare's network.

A useful mental model: User -> Cloudflare Edge (cache, security, edge logic) -> Origin. Requests flow through the edge before -- or instead of -- reaching your actual server.

Cloudflare doesn't have to be where your app lives. A common pattern: origin hosted elsewhere (a VPS, a PaaS, another cloud), with Cloudflare proxying, caching, and protecting traffic in front of it.

Edge Network: A geographically distributed set of data centers positioned close to end users, used to reduce latency for caching, security, and compute.

CDN: A content delivery network: a system of distributed servers that cache and serve static content from a location near the requesting user.

text

CLOUDFLARE AS AN EDGE LAYER
---------------------------
             +-------------------------+
             |     Cloudflare Edge     |
User ------->|  Cache | Security       |------->  Origin
             |  Edge Logic (Workers)   |
             +-------------------------+

Origin can be hosted anywhere -- a VPS, a PaaS, another
cloud provider. Cloudflare proxies, caches, and protects
traffic in front of it.

Connect it to a real scenario

Each DNS record in Cloudflare can be proxied (routes through the edge) or DNS only (resolves straight to origin). This one toggle decides whether Cloudflare's edge features apply to that record's traffic at all.

Caching rules decide what's served from the edge versus fetched fresh from origin. Security settings decide what suspicious traffic gets challenged or blocked before it costs your server anything.

Start with DNS and proxying

Point your domain to Cloudflare and enable proxying for basic caching and security with no code changes.

Tune caching and security

Adjust caching rules and security settings as you learn what traffic patterns your site actually sees.

Add Workers or Pages when needed

Reach for edge compute or edge-hosted deployment only once a concrete need appears -- not by default.

Because dashboard workflows change frequently, focus on the durable skill: recognizing whether the problem you're solving is about caching, security, or edge compute.

Cloudflare is an edge platform -- DNS, CDN, security, and edge compute (Workers) -- not just a DNS manager.
The mental model User -> Cloudflare Edge -> Origin applies whether the origin is a VPS, a PaaS, or another cloud provider.
Whether a DNS record is proxied or DNS-only determines whether Cloudflare's edge features apply to that traffic at all.

Try the working example

javascript

function classifyCloudflareLayer(request) {
  // request: { type: "static-asset" | "dynamic-api" | "edge-logic-needed" }
  if (request.type === "static-asset" && request.cacheable) {
    return "Cache";
  }
  if (request.type === "edge-logic-needed") {
    return "Edge Logic (Workers)";
  }
  return "Origin";
}

const examples = [
  { label: "logo.png", type: "static-asset", cacheable: true },
  { label: "A/B test redirect", type: "edge-logic-needed", cacheable: false },
  { label: "POST /api/orders", type: "dynamic-api", cacheable: false },
];

for (const ex of examples) {
  console.log(`${ex.label} -> ${classifyCloudflareLayer(ex)}`);
}

You should see

logo.png -> Cache
A/B test redirect -> Edge Logic (Workers)
POST /api/orders -> Origin

5-minute try-it

Pick a website you use daily. Guess which requests would likely be served from Cache, which might need Edge Logic, and which must reach Origin -- then explain your reasoning for each.

One important caution

Assuming Cloudflare automatically secures or speeds up a site the moment DNS points to it -- proxying, caching rules, and security settings still need to be configured deliberately.

Forgetting that if a DNS record is not proxied, none of Cloudflare's edge features (caching, WAF, Workers) apply to that record's traffic.

Cloudflare: How Cloudflare Works — Cloud Providers & Platforms