Cloudflare Review and Privacy Concerns

A friend approached me asking to do a Cloudflare review wondering if this free service does what it promises so I set out to do some testing.

Cloudflare says “Give us five minutes and we’ll supercharge your website.” – Cloudflare has you point the DNS records of your website to their DNS servers which results in all requests for your website being redirected to them first.

When they receive a request for your information, they analyze where the request came from (the ip address) to make sure it’s a legitimate request and not a spam bot, compromised pc or known threat. They also cache your content and spread it around servers they own in many locations so that your website is served faster.

In my Cloudflare review, I tested three servers of mine, one dedicated and extremely fast, another a high-end VPS and the other a slower shared server. To do the testing, I used a website recommend by Google, webpagetest, which allows testing from multiple locations throughout the world. Below you’ll find my test results:

Website A on dedicated server w/o cloudflare
From: Dulles, VA – IE8 – DSL (3.796)
First View 3.302s and repeat was 2.306s
First View 4.290s and repeat was 2.373s
From: London, UK – IE7 – DSL (4.9215)
First View 4.784s and repeat was 3.039s
First View 5.059s and repeat was 3.706s

Website A on dedicated server with cloudflare
From: Dulles, VA – IE8 – DSL (3.3165)
First View 2.294s and repeat was 0.995s
First View 4.339s and repeat was 1.791s
From: London, UK – IE7 – DSL (4.001)
First View 3.423s and repeat was 2.993s
First View 4.579s and repeat was 3.806s

Website B on High-end VPS w/o cloudflare
Testing from Dulles, VA – IE8 – DSL (1.649)
First View 1.670s and repeat was .833
First View 1.628s and repeat was .829s

Website B on High-end VPS with cloudflare
Testing from Dulles, VA – IE8 – DSL (2.152)
First View 1.628s and repeat was 1.231
First View 2.676s and repeat was 2.254s

Website C on shared server w/o cloudflare
From: Dulles, VA – IE8 – DSL (1.952)
First View 2.044s and repeat was 0.850s
First View 1.861s and repeat was 0.894s
From: London, UK – IE7 – DSL (3.118)
First View 3.281s and repeat was 2.291s
First View 2.956s and repeat was 1.939s

Website C on shared server with cloudflare
From: Dulles, VA – IE8 – DSL (1.503)
First View 1.520s and repeat was 0.538s
First View 1.486s and repeat was 0.516s
From: London, UK – IE7 – DSL (4.191)
First View 4.102s and repeat was 1.319s
First View 4.280s and repeat was 1.386s

How I factored the results in my Cloudflare review
First View and repeat is completed with the same browser session. I then closed the browser and initiated the second set of tests, so you’ll see two sets of First View and repeat results.

I took the first view times of both tests, then averaged them without looking at the repeat times. My focus is on what the googlebot would see at first visit.

Cloudflare Reports the following for each site:
Website A as taking 1.65 sec to load without their service and .94 seconds with their service making it 43% faster yet my tests show 3.796 sec to load w/o cloudflare and 3.3165 w cloudflare making it 12% faster

Website B as taking 1.33 sec to load without their service and .73 seconds with their service making it 45% faster yet my tests show 1.649 sec to load w/o cloudflare and 2.152 w cloudflare making it 23% slower

Website C as taking 1.28 sec to load without their service and .61 seconds with their service making it 52% faster yet my tests show 1.952 sec to load w/o cloudflare and 1.503 w cloudflare making it 23% faster

Final Cloudflare Speed Test Results
It appears that my high-end virtual private server (which is in the cloud) performs much better without cloudflare, my dedicated server noticed a small increase and my shared (low end) server noticed a nice increase in speed. Why their results are so different from webpagetest’s results is unknown, but as you can see, I tested this at multiple locations.

Cloudflare shows a cached image of your site when it’s offline and during my initial research, I noticed mention of a banner that’s placed on your cached content. I took my site offline and put this to the test – I did not find any additional code (except for the email obfuscation which can be turned off) in my cached content.

Update!
Just noticed this banner:

It said my server was unavailable and was serving a cached page. I checked the server and other sites on that server and found everything was running, so I’m guessing the problem was on their end but they served this message anyway. The image above is what was at the top of my site as they delivered my cached page.

If you’re into link love, will, you’re giving them a ton of it when this happens! Odd that when I first signed up, I didn’t see this banner, but after being with them awhile, it’s showing up now.

I did notice that when accessing their site (happened in multiple local locations), sometimes I would receive “The connection was reset. The connection to the server was reset while the page was loading.” – odd for a company that has servers around the world?

Incorrect IP addresses with Cloudflare

Cloudflare behaves like a reverse proxy, so let me take a sec and explain what this is:

A proxy is a server acting as an intermediary for requests from a website visitor seeking resources from a website. When you (the visitor) request information from a website, the proxy server hides your IP address and uses its own instead. The owner of the website sees the proxy’s IP address, not yours – the proxy is working for you, the visitor.

A reverse proxy works for the server, not the visitor. It acts as a gateway to a web server or web server farm by acting as the final IP address for requests from visitors. It hides the IP address of the webserver rather than the visitor.

Because Cloudflare acts as a reverse proxy, the IP address in your comments and applications running on your webserver will show a Cloudflare IP address and NOT the visitor’s ip address. This can mess up your log files and interfere with tracking and more. For adsense users, watch closely your adsense stats before and after using cloudflare – search Google for “cloudflare adsense” to research this yourself.

Cloudflare has an apache module called mod_cloudflare which can help record the correct ip address of visitors and for WordPress users, there is a Cloudflare plugin to ensure you have the correct IPs.

For details on a reverse proxy, check out sans.org/reading_room/whitepapers/webservers/reverse-proxy-proxy-name_302

Cloudflare and Supercache
I use supercache to speed up my websites and found no problems running cloudflare and supercache together. I read on the web that supercache made the site respond slower when running with cloudflare, but did not find this to be true; I tested with and without the plugin.

Cloudflare’s is not about making your site faster as much as it is about security. You’ll notice the threatening IP addresses that were blocked or challenged, along with the amount of bandwidth you saved by using their free service. Providing such a free service is expensive, especially if you have multiple servers distributing cached content around the world, but it’s not really free if you consider the information you’re providing them in return.

Cloudflare Privacy Concerns

By pointing your domain name’s name servers to Cloudflare, you’re giving them the crown jewels of your website. Some of my best sites were started because I reviewed my server log files and found patterns that revealed a niche; without those log files, my life would be much different.

As it stands now, when you start a website, you’re guessing that a term is popular and there is no grantee your idea is going to take off. But imagine the value of a database containing factual, verifiable data containing the hottest terms along with traffic numbers, referrals and more! Just one term could make you rich depending on the niche!

“CloudFlare may aggregate data we acquire about you and the visitors to your site.” and “If we assemble this sort of data and provide it to external parties, your personal information (such as your name, email address, and other information specifically tagged to your identity) will never be attached to or included in the aggregated data. Please note, public data you provide us, such as log files of your site’s visitors, may be included in the aggregate data, reports and statistics.”

and Information Collection:

“CloudFlare is the sole owner of the information collected on this site and through any CloudFlare service. As visitors browse our web site, or your sites if they are protected by CloudFlare, we sometimes track them in order to provide a better service.”

I could read this as, by using our free service, we own any information we gather from your website such as log files, we can track your visitors, we can compile a list of your hottest keywords and then sell this data as long as it doesn’t contain information that would identify you as a person. Cloudflare states “We will always maintain the overriding principle that we will not sell, rent, or give away any personal information…” which pertains only to your person and not your log files, hot topics, popular pages, referrers and other data.

Don’t confuse this with free dns services for individuals where activity can be tracked and then matched to other individuals to find a pattern (Free DNS companies still have to guess what’s popular). With Cloudflare, there is no matching, they have the motherlode, your server and proof that a topic or niche exists.

This type of data is in high demand and companies pay big bucks for such services! Information such as this is exactly what giants like Google look for when buying a company and I have no doubt that not to far in the distant future, the founders of cloudflare will be well rewarded for their creativity! (or Google / Microsoft will start a similar service : )

I mention the privacy concerns not because I distrust Cloudflare or have reason to believe their intentions are anything but honest, but because people can often forget what they are giving away when they accept free services such as this. I suggest you review their privacy policy at cloudflare.com/security-policy.html to learn more.

Summary Review of Cloudflare

If you have a site that’s performing well and don’t want that data sold to the highest bidder, then think carefully before jumping into such services. If however, you’re not concerned with data and focused instead on speed, Cloudflare may be for you. In my case, I tested three sites and found that it reduced the performance on the high-end VPS but made a marked improvement on my lower-end shared server; there is also the added benefit of increased security.

Besides having access to all that verifiable data, Cloudflare also benefits from hosting companies recommending Cloudflare to their clients. Since Cloudflare caches content and saves the hosting company bandwidth and server resources, it makes sense to push this service!

They get high marks for creativity, great marks for security, great marks for low-end servers, poor marks for high-end virtual private servers and a BIG WARNING to those concerned about non-personal privacy (such as your best keywords, traffic, referrers, etc.)

Cloudflare Review and Privacy Concerns, 9.7 out of 10 based on 31 ratings