What is Cloudflare?
Corbin Brown
2 min read
Part of the Vibe Coding Fundamentals video series on YouTube.
Cloudflare is a layer that sits between your website and everyone trying to reach it. Visitors don't connect to your site directly — they connect to Cloudflare, which checks them, serves what it can from its own copies, and passes the rest through. Think of it as three jobs in one: a bouncer (blocking attacks and bots), a courier network (serving your site from a location near each visitor), and a front desk (managing your domain's DNS). This very website runs through it.
Why so much of the web routes through it
Because the free tier does things that used to require an infrastructure team. HTTPS certificates, automatic. Protection against traffic-flood attacks, automatic. Copies of your site cached in hundreds of cities so it loads fast everywhere — that's the CDN part — automatic. For a vibe-coded project, pointing your domain at Cloudflare is one of the highest-leverage free moves available.
The settings that actually matter for builders
- “Always Use HTTPS” — turn it on. It forces every visitor onto the padlock version of your site, and it's a checkbox, not a project.
- Caching cuts both ways: if you deploy a fix and still see the old version, Cloudflare may be serving its saved copy. “Purge cache” in the dashboard is the answer, and knowing that saves you an hour of confused debugging.
- Check the AI crawler settings. Cloudflare can block AI bots by default — great for some sites, but if you want your product to show up in AI search and chat answers, those blocks work against you. We found this enabled on our own site and turned it off.
FAQ
Do I need Cloudflare if I'm on Vercel?
Not strictly — Vercel handles HTTPS and global serving on its own. People add Cloudflare on top for its DNS dashboard, bot rules, and security controls. Plenty of builders also buy their domains there because registration is at-cost.
Is Cloudflare why my site shows a “checking your browser” page?
Yes — that interstitial is Cloudflare challenging traffic it finds suspicious. You can tune how aggressive it is in the security settings; maximum settings can annoy real visitors, so default levels are right for most sites.