Cloudflare SEO Settings That Keep Googlebot In
technical seo guideWelcome, my friend. The short answer: Cloudflare is fine for SEO as long as it never blocks Googlebot, never causes a redirect loop, and never changes your pages in a way you haven’t tested. Five settings decide that, and I walk through each one below.
- let Googlebot through
- no redirect loops
- test before you trust
Full (strict), not Flexible
redirect in one place only
verified Googlebot allowed
off until a test says it is safe
read CF-Connecting-IP in logs
// example data: my starting checklist for a small WordPress site behind Cloudflare. It is not a client result.
What Cloudflare Changes for Your Site
Cloudflare sits between your visitors and your server and handles their requests first. Googlebot is a visitor too, so every Cloudflare rule applies to it as well.
Cloudflare’s own documentation says its cache rules require that you proxy the DNS records of your domain through Cloudflare. In plain words, the traffic goes through Cloudflare before it reaches your hosting. That is the whole trick, and it is why a setting you changed for security can quietly change what Google sees.
Cloudflare is a vendor, not Google, so I split my sources. Anything about how Cloudflare behaves comes from Cloudflare’s documentation. Anything about how Google behaves comes from Google. Where I only have my own experience, I say so.
Why Cloudflare Settings Matter for SEO
A wrong setting can make Google see errors, loops or blank pages while your own browser looks perfect. Because you test with your browser, you rarely notice.
Google’s documentation on HTTP status codes says that 5xx and 429 server errors prompt its crawlers to temporarily slow down. It adds that Google treats the 429 code as a signal that the server is overloaded. So if a Cloudflare rule challenges or rate-limits Googlebot, you can end up with slower crawling and nobody gets an alert.
There is a second risk. Google says the user-agent header Googlebot uses is often spoofed by other crawlers, and it recommends a reverse DNS lookup or a check against its published IP ranges to confirm a request. A rule built only on the words “Googlebot” in the user-agent will let fakes in. A rule that blocks everything unusual will keep the real one out.
Take a plumber in Austin whose WordPress site sits behind Cloudflare. Her security rule challenges any visitor from an unknown network. Googlebot gets the challenge page, not the service pages. Her own phone sails through, so she sees nothing wrong.
How to Set Up Cloudflare for SEO Step by Step
Start with the encryption mode, then redirects, then bot rules, then optional speed features. Check Search Console after each change.
- Choose the right SSL/TLS mode. Cloudflare lists four: Off, Flexible, Full and Full (strict). In Flexible, it says, traffic from visitors to Cloudflare can be encrypted but traffic from Cloudflare to your origin server is not. Cloudflare strongly recommends Full or Full (strict) where possible. Full (strict) adds validation of the origin server’s certificate.
- Redirect HTTP to HTTPS in one place. Google prefers HTTPS pages over equivalent HTTP pages as the canonical version. Pick either Cloudflare or your server to do the redirect, never both. This is my own rule from cleaning up loops.
- Allow verified bots. Cloudflare says a verified bot is one it has confirmed is transparent about who it is and what it does, and it lists Googlebot as an example. Its WAF custom rules can still use the verified bot categories. Build your rules so those bots pass.
- Check what Googlebot actually receives. Look for 429 or 5xx responses in your server logs for Google’s addresses, and for “Server error (5xx)” in Search Console, which Google defines as your server returning a 500-level error when the page was requested.
- Read the real visitor IP. Cloudflare passes the visitor address to your server in the CF-Connecting-IP header and recommends your logs and applications use it instead of X-Forwarded-For. Without it, your logs show Cloudflare’s addresses, and your Googlebot checks fail.
- Test Rocket Loader before you keep it. Cloudflare says it defers the loading of all your JavaScript until after rendering, and that if you see JavaScript or jQuery issues you should disable it and retest. Treat that as a test item, not a free speed boost.
- Re-check after every change. Open a key page, run a crawl, and look at Search Console again a few days later.
For the HTTPS side in more detail, read HTTPS and SEO. If a rule ever blocks a crawler you want, my page on robots.txt syntax rules covers the other half of crawler control.
Settings at a Glance, With Sources
Here is the checklist in table form. The last column tells you whether the point is a Google fact, a Cloudflare fact or my own habit.
| Setting | My starting point | Basis |
|---|---|---|
| SSL/TLS mode | Full (strict) | Cloudflare documentation |
| HTTP to HTTPS redirect | One layer only | My experience, plus Google’s HTTPS canonical preference |
| Bot and firewall rules | Verified Googlebot allowed | Cloudflare and Google documentation |
| Rocket Loader | Off until tested | Cloudflare documentation |
| Logging real IPs | Use CF-Connecting-IP | Cloudflare documentation |
// the “starting point” column is my recommendation. Cloudflare’s dashboard changes over time, so check names against what you see.
Common Cloudflare Mistakes and Fixes
Most problems I see come from stacking rules without testing them as Googlebot would. Here are the usual ones.
The Usual Slips
- Flexible mode plus a server redirect to HTTPS, which can loop forever (my experience)
- A challenge page shown to every unknown visitor, crawlers included
- Trusting the Googlebot user-agent text instead of verifying
- Turning on Rocket Loader and never testing the menus and forms
The Better Habit
- Use Full (strict) and keep the redirect in one layer
- Allow verified bots and challenge the rest
- Verify by reverse DNS or published IP ranges, as Google advises
- Disable and retest when JavaScript breaks, as Cloudflare advises
// the loop in the first card is my own experience. Cloudflare’s documentation page I read did not describe it, so I label it that way.
How to Check Everything Works
Test as a stranger, then check what Google reports. Your logged-in browser is the least useful test you own.
First, open your site in a private window and follow the redirect from the HTTP address to HTTPS. You should land on the final page in one hop. Second, crawl a few pages and look for challenge pages or odd status codes. Third, watch Search Console for server errors. Google notes that changes can take hours or several months to show, so give it time before you panic.
If speed was your reason for using Cloudflare, my guide to speeding up a WordPress site covers the other half of the job. A CDN helps, and it does not replace a lean site.
What It Costs and How Long It Takes
The review itself is short. I charge €25 an hour, and my own estimate for a small site is an hour or two to audit and fix the settings above.
I did not check Cloudflare’s current plan prices for this post, so I won’t quote any. Look at their pricing page before you decide. For the work, my technical SEO service covers this kind of check inside every plan. If you want the full picture of what I offer, start from my cheap SEO expert page.
Cloudflare and SEO Questions
Short answers to the questions I get most.
Is Cloudflare good or bad for SEO?
Neither by itself. It is a proxy, so it is only as good as your settings. Set it up so Googlebot gets normal pages and fast responses, and it causes no SEO harm that I know of.
Will Cloudflare block Googlebot?
It can, if you write a rule that does. Cloudflare lists Googlebot among its verified bots, so allow that category in your rules. Then check your logs for 429 and 5xx responses to Google.
Which SSL mode should I use?
Cloudflare strongly recommends Full or Full (strict) where possible. Full (strict) also validates your origin certificate. Avoid Flexible if your origin already redirects to HTTPS.
How do I confirm a visitor is really Googlebot?
Google says the best way is a reverse DNS lookup, or matching the source IP against its Googlebot IP ranges. Don’t rely on the user-agent text, because other crawlers often spoof it.
Should I use Rocket Loader?
Only after testing. Cloudflare says it defers JavaScript until after rendering, and tells you to disable it if you see JavaScript problems. Test your menus, forms and checkout first.
Send Me Your URL. I’ll Check What Googlebot Sees.
Message me your website address on WhatsApp and I’ll tell you what I would change first.
// the first look costs you one message.
Sources and Last Check
- Google Search Central: HTTP status codes, and network and DNS errors (429 and 5xx slow crawling)
- Google Search Central: Googlebot (verifying Googlebot, spoofed user-agents)
- Google Search Central: Consolidate duplicate URLs (HTTPS preferred as canonical)
- Search Console Help: Page indexing report (Server error (5xx) definition)
- Cloudflare Docs: SSL/TLS encryption modes (vendor documentation)
- Cloudflare Docs: Verified bots (vendor documentation)
- Cloudflare Docs: Rocket Loader (vendor documentation)
- Cloudflare Docs: HTTP request headers (CF-Connecting-IP, vendor documentation)
// last checked 11 Nov 2026. Cloudflare pages are vendor documentation, not Google or a standards body. The Flexible-mode loop and the one-layer redirect rule are my own experience.