Need for Cloudflare

Topic

New Reply

Hi Loungers,

We’re creating on a new WordPress site which is primarily to establish web presence for a new brand. At launch, site will consist of  a homepage, a few articles and images, a contact us link and the privacy/terms of use pages.

Currently in GTMetrix its performance is excellent with an LCP time of 564 ms and TBT of 0 ms.

Question:

• Given the GTMetrix results, do I need Cloudflare at this point?

As an aside, I’d love it if I can avoid adding Cloudflare right now…the fewer technical issues I have to contend with at launch, the better! However, if you advise me to add it, I will!!

Thanks for your advice (always),

Linda

 

Reply | Quote

Replies

No.
Just use caching (I’m assuming it’s a self-hosted site, not through wp dot com).  Ensure https is set up and use some plugins to keep out the bad guys.  Most importantly:

• ensure all folders have correct permissions, mostly 6440
• wp-config.sys is set with as low permissions as it can get away with – mine runs with 600.
  ensure an empty index.php file that is locked right out at 600 or lower is in the critical folders like wp-content and images folders, say with code like
  <?php
  // Silence is golden.
  ..if there’s no index file present
• the index in wp-admin should be set to 644

All of the above should be in correctly during the set up of a default WP install, but my own personal experience when my main index.php got hacked (many years ago now!!!) shows it’s worth to check these critical files and folders, don’t rely on the automatic script running without any glitches…..

If you need user interaction I’ve found that hCaptcha is a better alternative than the usual google one at validating robots out of your site.

n.b. for years I used caching plugins which worked fine but the free built-in systems through my host Krystal in the UK mean I don’t use them any longer as I use LightSpeed which caches on NGinx seamlessly in the background,  along with Lets Encrypt which supplies the SSL certificates for free.   It’s all good stuff since when I first started with WP back in 2007 where I had to do everything after the 5-min install.  Should you choose to give Krystal a try use this code for discount 0ae2ce51   I’ve been with them for half a decade now, a good independent host, all running on SSD, etc etc etc, even the cheapest package.

Martin

Reply | Quote

Wonderful information! Thank you so much, Martin. And I’m most happy with your “No” answer!! 🙂

I will take time to digest all of your suggestions and post back with any questions.

Yes, it is .org and I do have a caching plugin installed. Will have to double check https status … right now the site is hosted on my htpps main site as a sub-domain.

Back to you soon with results … and thanks again for all the detail you provided.

Linda

Reply | Quote

Martin, an update and apologies.

Our site project got delayed  so I have not yet got back to it to follow  all your helpful hints. We hope to be back at it this coming week so I can use your suggestions as a checklist. Once I have, I’ll post back to let you know how it went.

Hope to be back to you soon!

Linda

 

Reply | Quote

Hi Martin,

Hope you’re still following this dated thread of mine!

Finally, much later than hoped or planned, I am back trying to get our new site up and our current site put in the background. I re-read your post to get ready. Now I know what LightSpeed  and NGinx are…good learning! Also researched hCAPTCHA and, in doing so, discovered what CAPTCHA actually means! It seems a positive replacement for reCAPTCHA. I personally like to avoid Google wherever possible (and it’s not particularly possible to do so!).

I’ve got caching and security plugins installed on draft site.

Question: Do I check htpps status before or after making draft site live?

I’m pretty sure our host, InMotion, offers fress htpps, but am happy to learn of the free alternative you mentioned, Let’s Encrypt. It sounds ideal in the research I did.

Most importantly:

• ensure all folders have correct permissions, mostly 6440
• wp-config.sys is set with as low permissions as it can get away with – mine runs with 600.
  ensure an empty index.php file that is locked right out at 600 or lower is in the critical folders like wp-content and images folders, say with code like
  <?php
  // Silence is golden.
  ..if there’s no index file present
• the index in wp-admin should be set to 644

I don’t know how to do any of this, unfortunately. The terms are familiar, but the “how” is not. ;-(  If it important to do first, I will research to figure it out. My preference would be to get site loaded and working first, but I bow to your technical expertise!

Now back to getting final site tweaks completed and ready for upload.

Thank you again for your help and specific suggestions!

Linda

Reply | Quote