Cloudflare and CDN Security for Small Business Websites (2026)

A small business website rarely gets a dedicated security team, but it does get attacked. Cloudflare reported 18.2 million network-layer DDoS attacks in the third quarter of 2026 alone, and 96% of them ended within ten minutes, often before anyone noticed. Putting a content delivery network (CDN) in front of your site absorbs much of that traffic. This guide explains what a CDN protects, what the Cloudflare plans include, and what still needs fixing on the site itself.

What a CDN does for security

A CDN sits between visitors and your web server. Your domain's traffic goes to the CDN's network first, which serves cached pages, filters bad requests and only then passes clean traffic to your server, called the origin. Because attackers hit the CDN rather than your hosting account, a flood that would knock a small server offline is spread across a much larger network.

Security features usually ride along with the caching: DDoS mitigation, a web application firewall (WAF) that blocks known attack patterns, free TLS certificates for HTTPS, and bot and rate controls. For a small firm on shared or low-cost hosting, these are services it could not run itself.

The threat picture in 2026

Cloudflare's Q3 2026 DDoS report, published on 29 October 2026, counted 18.2 million network-layer attacks, roughly 8,226 every hour, plus 14.4 trillion malicious HTTP requests. Most attacks were small and fast: 98% stayed under 1 Gbps and 96% were over within ten minutes. That pattern hurts small sites most, because a short burst is enough to take a modest server down and is over before a person can respond.

Large attacks still happen. Cloudflare saw 251 attacks above 1 Tbps in the quarter, down from 805 in Q2, and UDP floods rose to 31.31% of network-layer attacks. The practical lesson is that protection has to be automatic and always on, not something you switch on after the site is down.

What the Cloudflare Free plan includes

Cloudflare's plans page lists unmetered DDoS protection, a Universal SSL certificate, the Free Managed Ruleset and the WAF on every plan, including Free at USD 0 a month. Its DDoS documentation confirms that both network-layer and HTTP-layer protection are available on Free, with one ruleset override per zone.

The WAF documentation adds detail. Free accounts can write custom rules, get one rate limiting rule and receive leaked credentials detection on one field, but they see only sampled security event logs and only the Free Managed Ruleset rather than the full managed rules. For a brochure site that is often enough. For a site with logins, forms or payments, the limits start to matter.

Free, Pro or Business: a comparison

The jump from Free to Pro buys the full WAF managed rules and full security event logs. Business adds security event alerts, attack scoring and PCI DSS 4.0 compliance support, along with a 100% uptime SLA. Prices below are from Cloudflare's plans page in November 2026.

Setup checklist for a small business site

Move your DNS to the CDN and make sure the records for your website are proxied, not just resolved, or the traffic will bypass it. Keep a valid TLS certificate on the origin server as well, so traffic is encrypted from the CDN to your host and not only from the visitor to the CDN. Then restrict the origin so it accepts web traffic only from the CDN's network, otherwise attackers can go round it.

Use your one free rate limiting rule on the login page or contact form, which are the most abused endpoints. Turn on the managed ruleset, review sampled events weekly for the first month, and write custom rules to block countries or paths you never serve.

• Proxy every public web record through the CDN
• Keep a valid certificate on the origin, not just at the edge
• Allow origin traffic only from the CDN's IP ranges
• Rate limit the login and form endpoints
• Review security events weekly during the first month

What a CDN will not fix

A CDN filters traffic; it does not patch your site. Patchstack's State of WordPress Security in 2026 report found 11,334 new WordPress ecosystem vulnerabilities in 2025, and its tests showed traditional hosting defences blocked only 12% of WordPress-specific attacks in one round and 26% of a broader set in another. Many attacks look like normal requests, so a generic ruleset cannot catch them all.

That is why updates, strong admin passwords with two-factor sign-in and removing unused plugins still come first. A WAF buys time between a vulnerability being published and your patch, which matters when Patchstack measured a weighted median of five hours to mass exploitation for heavily exploited flaws.

Logs, compliance and India-specific duties

Indian businesses should check log retention. CERT-In's April 2022 directions require covered entities to keep ICT logs for 180 days and to report incidents within six hours. The Free plan's sampled logs are not a full record, so keep your own server and application logs for that period, or move to a plan with full event logs.

If the site takes card payments, Business is the tier that lists PCI DSS 4.0 compliance. XDQ Labs sets up and tests CDN and WAF configurations for small business sites on systems the owner authorises, but the checklist above is enough to get most sites to a sound baseline in an afternoon.

Frequently asked questions

Sources

1. Cloudflare DDoS Threat Report 2026 Q3, Cloudflare, 2026
2. Cloudflare plans and pricing, Cloudflare, 2026
3. State of WordPress Security in 2026, Patchstack, 2026
4. Cloudflare DDoS Protection documentation, Cloudflare Docs, 2026
5. Cloudflare Web Application Firewall documentation, Cloudflare Docs, 2026
6. The CERT-In Cyber Security Directions: More Questions Than Answers, Cyril Amarchand Mangaldas, 2022