Why We Chose Cloudflare — A Static Blog's Three Layers of Defense
Two days after launching this blog, I opened the traffic stats. 5,000 requests in 7 days, from 26 countries.
For a brand-new blog with three posts? The excitement lasted ten seconds. Digging in: 80% were 4xx errors (4,000 of them), 3,650 probes groping for json files, and the top country was the Netherlands — a dense VPS hosting region. Not readers. Vulnerability scanners.
The moment a new domain appears in DNS, the bots come. They look for WordPress
admin pages, grope for .env files, and throw published exploit code at
anything with an IP. They don’t check whether the target is a three-post blog.
But we already had three layers of defense. All free. This post is about why.
It’s not the DNS — it’s the proxy
Cloudflare manages DNS for aticaa.io. But Cloudflare’s real value isn’t the DNS (an address board). It’s the orange cloud icon next to each DNS record — the proxy.
When the cloud is gray, Cloudflare tells visitors your address and steps aside. When it’s orange, all traffic passes through Cloudflare’s edge. And at that checkpoint, these things happen for free:
- Managed WAF — blocks attack patterns of known vulnerabilities (CVEs) by signature
- DDoS protection — unmetered, included in the free plan
- Automatic SSL certificates — issuance and renewal, fully automated
- CDN caching — static assets served from edges worldwide
- Cookieless analytics — the thing that let our privacy policy fit on one page
- Five custom firewall rules — blocking rules you design yourself
A Korean domain registrar’s DNS stops at the address board. Korea has WAF and CDN services too, but they’re all paid enterprise products — a “this whole set, free, for individuals” tier simply doesn’t exist here. Cloudflare’s free plan is an anomaly even globally.
Three layers of defense
A malicious request aimed at this blog has to pass three gates. It can’t.
Layer 1 — Cloudflare’s managed rules. Yesterday’s log showed three requests from a single AWS server in France, all blocked. The managed ruleset that ships with the free plan — which we never configured — caught known exploit patterns on its own.
Layer 2 — a custom WAF rule. I wrote one rule that slams the door on the
paths scanners knock on (/wp-, .php, /.env, /.git, and so on). On a
static site these paths are 404s anyway, but bots don’t deserve even a 404.
Two lessons from designing it. If you match /admin with a “contains”
condition, you’ll also block a future legitimate post like
/posts/admin-ux-design — we switched it to “starts with.” And if you
apply the rule zone-wide, you strafe your own API subdomain on the same zone —
we scoped it to the blog host. With blocking rules, the skill shows not in
writing them but in designing against false positives.
Layer 3 — the nature of a static site. The last line of defense, and the strongest. This blog has zero lines of server code. No login, no database, nothing that executes. A house with nothing to break into doesn’t get broken into.
The honest trade-offs
No free lunch, as the principle goes — two things are worth knowing upfront.
Single dependency. All traffic passes through Cloudflare, so when Cloudflare goes down, we go down with it. It really does happen — every few years there’s a day when half the internet stops together. We know the risk and accepted it; traded against a personal blog’s availability requirements, it’s a good deal.
Free-plan routing in Korea. The free plan’s Korean traffic used to have a reputation for detouring through overseas edges, due to peering costs with Korean ISPs. It’s much improved now, and with a static-plus-cache setup like ours the impact is small anyway. Still, it’s on our list to measure if domestic traffic ever grows.
And it’s worth thinking about why Cloudflare gives this away. Free users’ traffic is the sensor network that trains their threat detection. The scanner that knocked on our blog yesterday has probably become a signature somewhere by now. We pay in data instead of fees — and by the standard of a blog that chose cookieless analytics, that was an acceptable trade.
Summary
If you’re building a static blog:
- Move your DNS to Cloudflare and turn the cloud orange — that’s most of it
- Spend one of your five custom rules blocking scanner paths — but design the false positives first
- The nature of a static site covers the rest
The bots come every day. We slept fine yesterday.
The record continues.