Run these checks on your own site with Edge Doctor for Cloudflare®, free on WordPress.org.
How to read a result
Every result has a status and a confidence: High, Medium or Low. Confidence says how sure the plugin is about what it measured, not how serious the finding is.
| Status | What it means | In Site Health |
|---|---|---|
| Passed | The check measured your site and found nothing to fix. | Good |
| Warning | The check found something that is likely a problem or a risk. It can be intended on your site. | Recommended |
| Failed | The check found a problem. | Critical when the confidence is High, otherwise Recommended |
| Info | A fact about your setup, worth knowing but not a problem in itself. | Good |
| Could not check | The plugin could not measure this reliably on your site, so it names the reason instead of guessing. | Good, unless no check in the group could run: then the group is Recommended |
| Not applicable | The check does not apply to your site, for example because the site is not behind Cloudflare. | Good |
You can ignore a warning or a failure. It stays ignored only while its evidence stays the same. When the evidence changes, the finding comes back.
All checks
Cloudflare connection and SSL
How Cloudflare reaches your server, and whether the SSL mode and the redirects fit your site.
- A1Cloudflare detection and connection typeWhether your site answers through Cloudflare, and how: proxied DNS, Cloudflare Tunnel, a Worker or a host-managed setup.
- A2Flexible SSLWhether visitors arrive over https while Cloudflare talks to your server over plain http.
- A3WordPress addresses still on httpWhether the WordPress Address or Site Address starts with http:// although visitors arrive over https.
- A4Redirect loops and HTTP to HTTPSThe redirect chains of your home page over http and https: loops, and a missing switch to https.
- A5Certificate on your serverThe TLS certificate your server presents: expiry, the name it covers and whether it is publicly trusted.
Visitor IP behind Cloudflare
Whether WordPress sees the real address of each visitor rather than a Cloudflare address.
- B1Real visitor IP not restoredWhether WordPress sees each visitor's own address or the address of a Cloudflare server.
- B2Pseudo IPv4 rewriting headersWhether Cloudflare replaces the IPv6 address of visitors with a made-up IPv4 address.
- B3Local proxy or Tunnel in front of WordPressWhether a proxy on your server, or a Cloudflare Tunnel, hides the visitor address from WordPress.
Private pages and Cloudflare cache
Whether pages meant for one person can end up in the shared cache, and whether the cache stays fresh.
- C1wp-admin and the login page in the cacheWhether Cloudflare may store wp-admin or the login page in its shared cache.
- C2WooCommerce cart, checkout and account in the cacheWhether the cart, the checkout and My account can be served from the shared cache.
- C3Logged-in pages in the public cacheWhether a page made for a logged-in user, with the admin bar, is served to anonymous visitors.
- C4REST API and Store API in the cacheWhether answers of the WordPress REST API and the WooCommerce Store API can be cached at the edge.
- C5Login cookies and private responsesWhether the cache respects WordPress login cookies and the Cache-Control: private header.
- C6Cached pages older than their noncesWhether cached pages carry WordPress nonces that expire before the cache does, which breaks forms.
- C7Cached HTML without a purgeWhether something clears the Cloudflare cache when you publish or edit content.
- C8Cookie-based features on cached pagesGeolocation, language detection and currency switchers that need per-visitor pages.
Cloudflare features that affect WordPress
Cloudflare features that rewrite your HTML on the way to the visitor.
Requests from your server to itself
Whether Cloudflare lets your server reach its own site, which WP-Cron, the REST API and Site Health rely on.
- E1Cloudflare blocking your own serverWhether Cloudflare challenges or blocks requests your server sends to its own site, such as WP-Cron.
- E2Cloudflare Access in front of admin-ajax.phpWhether Cloudflare Access redirects admin-ajax.php to its login.
- E3Cloudflare 52x errorsWhether Cloudflare answered any request with a 52x error page while the checks ran.
DNS and origin exposure
DNS records that send mail through the proxy or reveal the address of your server.
- F1Mail host behind the proxyWhether the host your MX record points to is proxied by Cloudflare, which mail does not pass through.
- F2DNS records revealing your serverWhether common subdomains point straight at the address of your server, outside Cloudflare.
- F3Apex and www out of stepWhether example.com and www.example.com both go through Cloudflare, or only one of them.
- F4Email revealing your serverWhether mail sent by WordPress may carry the IP address of your server in its headers.
Why a check could not run
When a check could not run, the result names a reason. Three reasons can affect many checks at once, so they have their own guide; every other reason is explained on the guide of the check that gave it.
- Your server could not reach its own siteYour server could not reach its own site, so this check had nothing to read.
- WordPress blocks requests to your own siteWordPress itself refused the requests from your site to itself, so none was sent.
- The login page could not be confirmedThe login page did not answer at wp-login.php, so it could not be checked.
Edge Doctor for Cloudflare® is not affiliated with or endorsed by Cloudflare, Inc. Cloudflare is a registered trademark of Cloudflare, Inc.