If Cloudflare doesn’t work, do not rip it out first. Split the problem into four buckets: DNS, proxy routing, caching, and security rules. Most “Cloudflare is down” complaints are really bad DNS records, an origin server timeout, an SSL mismatch, or an overexcited WAF rule blocking real shoppers. Fixing the right layer can turn a two-hour panic into a ten-minute repair.
TLDR: Start by pausing Cloudflare or switching a record from proxied to DNS only, then test the origin directly. For example, a store seeing 520 errors on checkout may discover that only 3 of 18 WAF rules caused 92% of blocked carts after a plugin update. If DNS is the issue, changing CDN providers will not help. If performance is the issue, compare Cloudflare against Fastly, Bunny CDN, Akamai, Amazon CloudFront, or another CDN with real traffic tests.
First: Identify What “Doesn’t Work” Means
Cloudflare is not one product. It is DNS, CDN, reverse proxy, SSL manager, bot filter, firewall, image optimizer, cache, and a stack of rules sitting between users and your server. That is useful until something breaks. Then every error page wears the same orange mask.
The fastest question is simple: Can the origin server work without Cloudflare? If yes, Cloudflare settings are likely involved. If no, your host, app, database, web server, or certificate may be the real problem.
- 522: Cloudflare reached out, but the origin did not respond in time.
- 521: The origin refused the connection.
- 520: A vague origin error. Annoying, but common.
- 525: SSL handshake failed between Cloudflare and the server.
- 403: Often a WAF, bot rule, country block, or host firewall issue.
Honestly, it feels like 520 exists to make people doubt their career choices. Still, it usually points back to the origin or a request pattern the origin dislikes.
Cloudflare Troubleshooting Checklist
1. Check the source server directly. Use the server IP, a temporary hosts file change, or a staging domain. If the origin is slow without Cloudflare, the CDN is not the villain. Check CPU, RAM, database locks, PHP workers, queue jobs, and web server logs.
2. Switch the DNS record to DNS only. In Cloudflare, this means turning the orange cloud gray for a record. Expect propagation quirks, but this test shows whether the proxy layer is causing trouble. Do this during low traffic if possible.
3. Review SSL mode. “Flexible” SSL is a frequent source of redirect loops. “Full” or “Full strict” is usually cleaner, but only if the origin has a valid certificate. If your site jumps between HTTP and HTTPS, check app settings too.
4. Purge cache with care. If the wrong page, broken CSS, or stale JavaScript keeps showing, purge affected URLs first. A full purge can spike origin traffic. That may make a slow server even slower.
5. Inspect firewall events. This is where many teams find the mess. A managed rule may block checkout, admin login, API calls, search, or webhook requests. Filter by path, IP, country, action, and user agent. If real users are blocked, create a narrow exception instead of turning off the whole WAF.
6. Check page rules and redirect rules. One bad rule can loop a site forever. Another can cache private pages. It drives me crazy that a single old rule from 2021 can still break a modern deployment.
When Cloudflare Is the Wrong Tool
Cloudflare is strong for many sites, especially when teams want DNS, CDN, basic DDoS protection, and WAF controls in one place. But it is not always the best fit.
If you need fine-grained edge logic, Fastly may feel better. Developers often like its control, logs, and VCL-based behavior. If you need a large enterprise delivery network with deep media features, Akamai is still a serious option. If price and simplicity matter most, Bunny CDN can be refreshingly direct. For teams already deep in AWS, Amazon CloudFront pairs well with S3, ALB, Lambda@Edge, and AWS WAF.
Cloudflare can also be awkward for companies with strict logging, compliance, or routing needs. Some users dislike how much sits behind one control panel. If DNS, WAF, cache, and edge rules all live in one vendor, a mistake hits everything at once.
CDN Alternatives: When Speed Is the Main Problem
Choose a CDN alternative when your issue is latency, cache control, video delivery, global reach, log access, or edge customization. Do not switch CDNs because of a broken DNS record. That is like replacing a car because the key battery died.
- Fastly: Great for custom edge logic, instant purges, detailed controls, and high-traffic publishing.
- Akamai: Strong enterprise choice for media, security, and global scale.
- Bunny CDN: Budget-friendly, simple, and often fast for small and mid-size sites.
- Amazon CloudFront: Best fit for AWS-heavy teams and serverless setups.
- Google Cloud CDN: Good for Google Cloud workloads and global load balancing.
- Azure Front Door: Useful for Microsoft-centric environments and app routing.
Run tests before moving. Compare time to first byte, cache hit ratio, image weight, error rate, and regional speed. A CDN that wins in New York may lose in Sydney.
DNS Alternatives: When Resolution Is the Issue
DNS problems look like random downtime, email trouble, slow domain resolution, or records that refuse to behave. If Cloudflare DNS is not a fit, consider Amazon Route 53, DNS Made Easy, NS1, Google Cloud DNS, or Azure DNS.
Look for low query latency, excellent uptime history, clear record management, DNSSEC support, API access, and sane pricing. Also check how the provider handles failover. Some DNS platforms offer health checks that can shift traffic when a server stops responding.
Before changing DNS providers, export every record. That includes MX, TXT, SPF, DKIM, DMARC, CNAME, AAAA, SRV, and verification records. Missing one TXT record can break email delivery or third-party tools.
WAF Alternatives: When Security Rules Cause Pain
A WAF should block bad traffic without punching real users in the face. When Cloudflare WAF blocks legitimate sessions, start with logs. Do not guess. Check the rule ID, path, country, IP reputation, and payload.
If you need a different WAF, compare Sucuri, Imperva, AWS WAF, Fastly Next Gen WAF, F5 Distributed Cloud WAF, and Akamai App and API Protector. Some are easier for small websites. Others are built for large apps, APIs, and compliance teams.
- For WordPress cleanup and protection: Sucuri is a common choice.
- For enterprise app security: Imperva, Akamai, and F5 are strong candidates.
- For AWS apps: AWS WAF is practical and integrates cleanly.
- For developer-friendly rule tuning: Fastly’s security tooling is worth testing.
A Practical Decision Path
Use this order before you migrate:
- Test origin health. If the server is failing, fix hosting first.
- Bypass the proxy. If the site works, inspect Cloudflare rules, cache, and SSL.
- Check DNS records. Wrong A, CNAME, MX, or TXT records cause strange failures.
- Review WAF events. If real users are blocked, tune rules.
- Benchmark alternatives. Test with production-like traffic, not one synthetic ping.
Expect to waste time on small settings. A proxy timeout, a cached redirect, or a forgotten page rule can look like a full platform failure. The goal is not to defend Cloudflare or blame it. The goal is to locate the broken layer.
Cloudflare works well for many sites, but it is not magic. Treat it as a stack of separate tools. Troubleshoot each one. Then decide if you need a CDN, DNS provider, WAF, or all-in-one replacement. That choice will be much clearer once the error stops hiding behind the orange cloud.