In this guide · 8 sections
- 01What Cloudflare does for a small business website
- 02Before you start: the DNS records you must not lose
- 03Proxied vs DNS-only: never proxy mail
- 04Switching nameservers, including .sg domains
- 05SSL settings: use Full (strict)
- 06Basic security settings worth turning on
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Add the domain to Cloudflare, check every imported DNS record against your old provider, set website records to Proxied and anything mail-related to DNS only, turn off DNSSEC (and any .sg RegistryLock) before changing nameservers, then set SSL/TLS to Full (strict).
What Cloudflare does for a small business website
Cloudflare sits between visitors and your web host. When a record is proxied (the orange cloud), visitors connect to Cloudflare, which filters attacks, caches files and forwards real requests to your server.
| Plan (Oct 2026) | Price | Useful for SMEs |
|---|---|---|
| Free | US$0 | DNS, CDN, DDoS protection, free edge SSL, Free Managed Ruleset, 5 custom WAF rules |
| Pro | US$20/mo billed annually, US$25 monthly | Cloudflare Managed Ruleset and OWASP rules, 20 custom rules |
| Business | US$200/mo billed annually | More rules and support; rarely needed by small sites |
Sources: Cloudflare plans, WAF managed rules and custom rules. For most small business websites, the Free plan is enough.
Before you start: the DNS records you must not lose
Moving to Cloudflare means Cloudflare's nameservers answer for your whole domain, not just the website. Any record you forget stops working when you switch. Cloudflare's setup guide warns that its automatic DNS scan is not guaranteed to find every record.
Pre-migration DNS inventory
If DNS record types are unfamiliar, read our guide to DNS records explained: A, CNAME, MX and TXT first.
Proxied vs DNS-only: never proxy mail
Cloudflare's proxy status documentation says only A, AAAA and CNAME records can be proxied; MX and TXT are always DNS-only. It recommends proxying records that serve web traffic, and not proxying records used for other purposes, such as domain verification CNAMEs.
| Record | Proxy status | Why |
|---|---|---|
| A or CNAME for example.sg and www | Proxied | Website traffic gets protection and caching |
| MX records | DNS only (fixed) | Mail does not go through Cloudflare's web proxy |
| A record for mail, webmail, smtp or imap | DNS only | Cloudflare's own email records example uses DNS only for the mail server |
| autodiscover, verification CNAMEs | DNS only | Must return the real target for Microsoft 365, Google or other services |
| SPF, DKIM, DMARC (TXT) | DNS only (fixed) | Text records are never proxied |
| FTP, SSH, cPanel on non-web ports | DNS only | The proxy only handles web traffic |
Our guide to connecting a domain to a website without breaking email covers the same trap with other DNS providers.
Switching nameservers, including .sg domains
Once the records in Cloudflare match your old DNS, you change the nameservers at your registrar to the two Cloudflare gives you.
Turn off DNSSEC at the registrar first
Cloudflare's setup guide says changing nameservers while DNSSEC is active can make the domain unreachable. For .sg domains, SGNIC's WHOIS shows "Signed" if DNSSEC is on.
Unlock RegistryLock if your .sg domain uses it
SGNIC rejects nameserver and DS record changes on RegistryLock domains. The administrative contact must unlock it in SGNIC's VerifiedID@SG & RegistryLock portal first.
Replace the nameservers at the registrar
Remove the old nameservers and enter Cloudflare's two. Do it during a quiet period, not before a campaign launch.
Wait for Cloudflare to show the domain as active
Propagation varies. Keep the old DNS provider's records unchanged until Cloudflare confirms.
Test website and email
Load the site on mobile data, send and receive email from an outside account, and check any subdomains.
Re-enable DNSSEC and RegistryLock
Turn on DNSSEC in Cloudflare, add the DS record at the registrar, then lock the .sg domain again.
Sources: SGNIC's RegistryLock FAQ and DNSSEC FAQ.
SSL settings: use Full (strict)
Cloudflare encrypts the connection between visitors and Cloudflare automatically. The SSL/TLS mode controls the second leg, from Cloudflare to your server.
- Flexible: Cloudflare talks to your server unencrypted. Avoid it; it can also cause redirect loops on WordPress sites that force HTTPS.
- Full: encrypted, but Cloudflare does not check the certificate is valid.
- Full (strict): encrypted and the certificate is checked. Use this.
Cloudflare's Full (strict) documentation says your server's certificate must be unexpired, issued by a publicly trusted authority or Cloudflare's Origin CA, and match the hostname. Most hosts provide a free certificate; if yours does not, install a free Cloudflare Origin CA certificate on the server. If the site shows certificate errors after the switch, see our SSL certificate expired fix guide.
Basic security settings worth turning on
After the move, a few minutes in the dashboard adds useful protection on the Free plan.
- Always Use HTTPS and Automatic HTTPS Rewrites so visitors never land on plain HTTP.
- Free Managed Ruleset, which Cloudflare describes as protection against high-impact, widely exploited vulnerabilities.
- A custom rule for your login page, for example challenging requests to /wp-login.php or /wp-admin from outside Singapore if your staff are all local. The Free plan allows 5 custom rules.
- Bot Fight Mode, tested first; it can block legitimate tools such as payment webhooks or uptime monitors.
- Two-factor authentication on the Cloudflare account, and a second admin so you are not locked out.
Cloudflare protects the front door; your website still needs updates, strong admin passwords and backups.
Do it yourself or get help?
A simple website with email on Microsoft 365 or Google Workspace can be moved to Cloudflare in an hour by someone comfortable with DNS, following the inventory and steps above. The risk is almost entirely in forgotten or proxied mail records.
Our Domain & DNS Setup (S$99) moves your DNS to Cloudflare with a record-by-record check and email testing, including .sg DNSSEC and RegistryLock. Website Security Hardening (S$290) adds SSL Full (strict), WAF rules for your login pages and other hardening on the site itself.
Frequently asked questions
For most small business websites, yes. As of October 2026 the Free plan includes DNS, CDN caching, DDoS protection, free edge SSL, the Free Managed Ruleset and 5 custom WAF rules. Pro, at US$20 a month billed annually, adds broader managed rulesets that busier or higher-risk sites may want.
It can if records are missed or set up wrongly. Copy every MX, SPF, DKIM, DMARC and verification record into Cloudflare, and keep any record your mail server uses, such as mail or autodiscover, as DNS only. Test sending and receiving from an outside account right after the nameserver change.
No. Proxy the A, AAAA and CNAME records that serve your website. Keep mail server records, verification CNAMEs and records for services on non-web ports as DNS only. MX and TXT records cannot be proxied at all. Proxying the wrong record is the most common cause of broken email after a move.
Full (strict). It encrypts the connection from Cloudflare to your server and checks that the server's certificate is valid, unexpired and matches your domain. Avoid Flexible, which leaves that connection unencrypted and can cause redirect loops. Install your host's free certificate or a Cloudflare Origin CA certificate.
Two common reasons: DNSSEC is still enabled, or the domain has SGNIC's RegistryLock turned on, which rejects nameserver and DS record changes. Turn off DNSSEC at your registrar and ask the administrative contact to unlock the domain in SGNIC's portal, then make the change and re-enable both afterwards.