We manage over 60 domains on Cloudflare, the service that sits between visitors and servers. It routes traffic, filters suspicious requests and caches files that do not change, keeping a copy close to the visitor.
Cloudflare traffic only
Our servers only accept web traffic from Cloudflare's addresses. Anyone trying to reach a site by going straight to the server's IP finds the door shut, so every request passes through the filter first.
With php2shell this really paid off. When those PHP flaws came out, Cloudflare switched on WAF rules, its web application firewall, against the known attacks. On our sites those rules covered all traffic during the hours when the PHP update for our servers was not yet available.
The cache rule that got us into trouble
On 20 October 2026, on a sailing regatta site, we found a "cache everything" rule written for the old site. With the new site, built on Laravel and Inertia, it was causing damage.
Inertia is the piece that makes a Laravel app behave like a modern application. The same address returns the HTML page when you arrive from the browser, and raw JSON data when you move around inside the app.
To tell the two apart, the server sends a Vary: X-Inertia header, which tells caches to keep two separate copies. Cloudflare, however, ignores Vary: X-Inertia and was keeping just one.
The upshot: sometimes visitors got raw data instead of the page, a screen of unreadable text. Other times they got an old version of the page.
The rule we now apply everywhere
- Cache files with a fingerprint in their name, the ones under
/build/*. These are compiled CSS and JavaScript, and the name changes with every release, so an old copy can never be mistaken for the new one. - Cache uploaded files, the ones under
/storage/*: images, PDFs, attachments. - Never cache an app's HTML pages.
That way the heavy files are served by Cloudflare, close to the visitor, and pages always arrive fresh from the server.
We also took away a working habit: when a site is rebuilt, the old site's cache rules get reviewed before go-live. Otherwise they sit there quietly until someone notices from the wrong side.
One domain on the Pro plan
We also moved one domain to Cloudflare's Pro plan to test speed from Italy. The difference is in the route: on the Pro plan, Italian visits go through the Rome node instead of Zurich.
A closer node means a shorter trip for every request. How much that matters in practice depends on the site and where its audience is, so we judge it case by case.
What we recommend
- If your site sits behind Cloudflare, close the server to everything else. Otherwise the filter can be bypassed through the side door.
- When you rebuild a site, check the old cache rules before going live.
- For an app: static files in the cache, HTML pages out. Fingerprinted files can stay cached for a long time, because a new release brings new names.
