Stack playbook · Snapshot 23 October 2026

WordPress on Cloudflare: readiness playbook

What 1,893 measured sites on this stack get right, where they fall short, and the WordPress on Cloudflare-specific steps that close each gap.

Sites measured: 1,893
Median readiness index: 68/100
Profiles on this stack: 889

Readiness by lane

Enable

92/100

All sites 77

Harden

54/100

All sites 56

Accelerate

73/100

All sites 64

Recover

1/100

All sites 10

The WordPress on Cloudflare playbook

Gaps ordered by impact, with the platform-specific step where one exists.

HSTS kept for at least a year
24% observed · all sites 34%
Send Strict-Transport-Security on HTTPS responses. Start with a short max-age (for example 300 seconds), confirm every subdomain works over HTTPS, then raise it in steps to 31536000. Add includeSubDomains only when all subdomains are HTTPS. HSTS preload is optional and hard to undo; hstspreload.org itself does not recommend it by default.
On Cloudflare: Enable HSTS under SSL/TLS > Edge Certificates > HTTP Strict Transport Security and raise max-age gradually.
Guide: HTTPS and TLS Guide for Website Owners
DMARC policy enforces quarantine or reject
25% observed · all sites 39%
Publish DMARC with p=none and a reporting address first, fix any legitimate senders that fail SPF or DKIM alignment, then move to quarantine and finally reject.
Guide: A Practical Website Health Check for Owners
security.txt published
3.3% observed · all sites 7.1%
Publish /.well-known/security.txt with at least Contact and Expires fields, as RFC 9116 requires, and review it before it expires.
On Cloudflare: Cloudflare Security Center can serve a security.txt file for the zone.
Guide: A Practical Website Health Check for Owners
No render-blocking scripts in <head>
32% observed · all sites 48%
Add defer to scripts that need the DOM, async to independent ones such as analytics, or move them to the end of the body.
On WordPress: Since WordPress 6.3, scripts can be registered with a defer or async loading strategy.
Guide: Control Third-Party Scripts Before They Control Your Page
CAA records limit who can issue certificates
16% observed · all sites 13%
Publish CAA records naming every CA you actually use, including the CAs your CDN uses for managed certificates. Add an iodef contact if you want reports.
On Cloudflare: Cloudflare documents which CAs its managed certificates need; include them in your CAA records.
Guide: HTTPS and TLS Guide for Website Owners
Content Security Policy present
19% observed · all sites 32%
Start with Content-Security-Policy-Report-Only to see what would break, tighten the policy over a few weeks, then enforce it.
Guide: Payment Security and PCI DSS: What Website Owners Need to Know
Modern image formats in use
48% observed · all sites 40%
Serve WebP or AVIF with a JPEG or PNG fallback, either through an image CDN or by generating both formats at build time.
On WordPress: WordPress has supported WebP uploads since 5.8 and AVIF since 6.5; image plugins or the host can convert existing images.
On Cloudflare: Cloudflare Polish can convert images to WebP.
Guide: AVIF, WebP, JPEG, and PNG: Choose the Right Image Format
DNSSEC signed
5.3% observed · all sites 8%
Enable DNSSEC at your DNS provider, then add the DS record at your registrar. Plan provider moves carefully: a stale DS record can make the domain fail to resolve.
On Cloudflare: Enable DNSSEC in DNS > Settings and add the DS record at the registrar.
Guide: Website Uptime Readiness: Prepare Before Traffic Arrives

Where WordPress on Cloudflare sites lead

HTTP/3 advertised80% observedall sites 37%
Reachable over IPv689% observedall sites 48%
Structured data present86% observedall sites 51%
Certificate lifetime of 100 days or less97% observedall sites 67%

All 31 checks on WordPress on Cloudflare

Check	Lane	Observed	All sites	Measured
HTTP requests move to HTTPS	Harden	94%	91%	1,798
HSTS kept for at least a year	Harden	24%	34%	1,893
TLS 1.3 negotiated	Harden	98%	91%	1,893
Certificate has more than 14 days left	Harden	100%	99%	1,893
Certificate lifetime of 100 days or less	Harden	97%	67%	1,893
CAA records limit who can issue certificates	Harden	16%	13%	1,891
DNSSEC signed	Harden	5.3%	8%	1,892
security.txt published	Harden	3.3%	7.1%	1,867
DMARC policy enforces quarantine or reject	Harden	25%	39%	1,893
X-Content-Type-Options: nosniff	Harden	41%	48%	1,893
Framing restricted	Harden	34%	51%	1,893
Content Security Policy present	Harden	19%	32%	1,893
Referrer-Policy set	Harden	26%	24%	1,893
HTTP/2 negotiated	Accelerate	>99%	90%	1,893
HTTP/3 advertised	Accelerate	80%	37%	1,893
HTML compressed	Accelerate	100%	93%	1,893
Static files cached for 30 days or more	Accelerate	67%	51%	1,777
Modern image formats in use	Accelerate	48%	40%	1,813
Offscreen images lazy-loaded	Accelerate	68%	62%	1,738
No render-blocking scripts in <head>	Accelerate	32%	48%	1,893
robots.txt published	Enable	97%	76%	1,870
XML sitemap discoverable	Enable	95%	70%	1,883
Reachable over IPv6	Enable	89%	48%	1,892
Canonical URL declared	Enable	94%	68%	1,893
Meta description written	Enable	88%	84%	1,893
Mobile viewport configured	Enable	>99%	94%	1,893
Structured data present	Enable	86%	51%	1,893
Social preview image set	Enable	63%	57%	1,893
Page language declared	Enable	98%	90%	1,893
At most one redirect to the homepage	Enable	99%	98%	1,893
Nameservers spread across providers	Recover	<1%	10%	1,892

High-readiness WordPress on Cloudflare sites

WordPress Next.js on Cloudflare WordPress on Amazon CloudFront Nuxt on Cloudflare Drupal on Cloudflare Cloudflare customers compared Service guide: WordPress Service guide: Cloudflare All stack playbooks