Cloudflare

Item: Cloudflare
Rating: 93
Author: Fast WordPress

by Cloudflare

Edge caching, image resizing and a WAF that never touches PHP.

93 · Fast4.6FreemiumLight impact

Visit official site See alternatives

This link may earn us a commission. It does not affect the score. Last tested 31 August 2026.

Measured result

Cloudflare on bench-01

Performance score

Measured on a 2 vCPU reference host

LCP: 1.29 s
CLS: 0.01
TTFB: 96 ms
Page: 560 KB
Requests: 28
Impact: Light

Median of 3 cold-cache runs, 31 August 2026.

How we tested

A clean WordPress 6.8 install on a 2 vCPU / 4 GB London host, PHP 8.3, 20 posts and one page builder template. We record a baseline, activate Cloudflare with its default settings, and re-run three cold-cache tests. The published figure is the median.

Where Cloudflare ranks elsewhere

Publisher	List	Position
WPBeginner	Best WordPress Security Plugins	#1 of 8
WPBeginner	Must Have WordPress Plugins for Every Website	#19 of 24

Positions are read from the published articles themselves, so they reflect that publisher's order rather than ours. Lists get re-ordered over time, so follow the link if you want the current version.

What changed in the latest version

v4.14.4Latest release2026-07-13

Guard against non-string parse_url result in pathIsNotForFeeds.
Unit tests for Hooks.php covering private helpers, purgeCacheByRelevantURLs, isEnabled methods, getPostRelatedLinks, and cache purge event handlers.
Extract WP core class stubs into a shared test fixture and bootstrap.
Bumped symfony/yaml from 5.4.45 to 5.4.52.
Bumped symfony/polyfill-intl-idn from 1.37.0 to 1.38.1.
Declare least-privilege permissions on php-build, php, and stale CI workflows.

v4.14.32026-05-12

Replace FQCN type hints with imported aliases for LoggerInterface.

v4.14.22025-12-22

Set correct type for $logger parameter in deprecated CF\WordPress\Datastore constructor.
Removed contructor parameter types from deprecated CF\Integration\DefaultIntegration to prevent outdated integration errors.
Instead of directly loading the polyfil Normalizer in global namespace, patched polyfill-intl-idn to use vendor prefixed Normalizer.

Release notes are the developer's own words, published on WordPress.org. Read the full changelog

Pros & cons

Static assets served from the edge with no origin hit
Firewall runs before WordPress boots
Free tier is genuinely usable

HTML caching needs page rules and careful exclusions
Purge behaviour must be wired to your cache plugin

The full review

A CDN in front of WordPress changes the shape of the problem: with edge caching enabled our reference site returned HTML in 96 ms from a distant test location, against 640 ms direct to origin.

The plugin itself is thin. Most of the work is in the Cloudflare dashboard - cache rules, an exclusion for logged-in cookies, and an automatic purge on publish.